Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do i disable remote access for non-root users over ssh? i would like to do this on demand if possible.

share|improve this question
up vote 8 down vote accepted

Everyone is doing this the hard way.. he said deny for all non-root users.. so just edit


Add the following

AllowGroups wheel root

Then restart ssh

Anyone in the wheel or root group will be allowed to ssh in

share|improve this answer
he said 'on demand' – b0fh Aug 9 '10 at 12:58

Several possibilities:

  • /bin/false as login shell for the normal users in /etc/passwd
  • Add only root to AllowUsers in /etc/ssh/sshd_config
share|improve this answer
/bin/false in /etc/passwd would also disable local access. – mkudlacek Aug 9 '10 at 11:44

Can use PAM as well: cp /etc/security/access.conf /etc/security/sshd.conf
echo "+ : root : ALL" >> /etc/security/sshd.conf
echo "- : ALL : ALL" >> /etc/security/sshd.conf

Then modify /etc/pam.d/sshd to add the following line after the other accounts:
account required accessfile=/etc/security/sshd.conf

This will also allow you to restrict by network if you decide to do so in the future.

share|improve this answer

If you want it to be on-demand, the standard way is to use /etc/nologin (have a look at man 5 nologin).

Creating this file (with an optional message inside) will deny non-admin logins and display the message instead; removing the file will allow logins back.

It can be applied to ssh, local logins, and anything else that uses PAM; just make sure that the PAM configuration for the service requires (It does by default for ssh and console logins on many distributions)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.