Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

The goal here is to create a script to easily manage reservation for a machine. When a user reserve the machine, it should be the only one able to access the machine for a given time (except admins of course).

I already found a solution with PAM. This single line in /etc/pam.d/sshd would have resolve my problem:

auth required item=user sense=allow file=/etc/ssh/sshd.allow onerr=fail

with the user login in /etc/ssh/sshd.allow

But it does not work at all:

$ cat /etc/ssh/sshd.allow 

$ tail -f /var/log/auth.log
Dec  1 12:12:05 mini sshd[2697]: Accepted publickey for bar from port 58087 ssh2
Dec  1 12:12:05 mini sshd[2697]: pam_unix(sshd:session): session opened for user bar by (uid=0)

Here the /etc/pam.d/sshd file

# PAM configuration for the Secure Shell service
auth       required # [1]
auth       required envfile=/etc/default/locale
auth required item=user sense=allow file=/etc/ssh/sshd.allow onerr=fail
@include common-auth
account    required
@include common-account
@include common-session
session    optional # [1]
session    optional standard noenv # [1]
session    required
@include common-password

I am running a Debian Squeeze box, I don't know if the behaviour of PAM is different with this.

share|improve this question
What does the rest of the stack look like? – Ignacio Vazquez-Abrams Dec 1 '10 at 11:34
Could you confirm that your sshd is set up to use the PAM service, with grep PAM /etc/ssh/sshd_config? – MadHatter Dec 1 '10 at 11:40
@MatHatter: I confirm, sshd uses PAM – Jérôme Dec 1 '10 at 13:31
@Ignacio: what do you mean with the stack? – Jérôme Dec 1 '10 at 13:32
The stack of PAM directives within the same configuration file, account, auth, password, and session. – Ignacio Vazquez-Abrams Dec 1 '10 at 13:34

3 Answers 3

Similar idea to above: Could you use AllowGroups in sshd.conf to allow a specific group (+ a group for admins), then add and remove users from the group using your authentication system, preventing you from having to edit files at all, or at least only edit files with well established interfaces (/etc/group via usermod etc).

share|improve this answer

Why you didnt use in /etc/ssh/sshd_config in section AllowUsers user1 user2 user3

share|improve this answer
Because I want to be able to dynamically generate a list of users which are able to connect. With your solution, I should parse and edit sshd_config file in my script... Not safe. – Jérôme Dec 1 '10 at 13:31

You can very easily use pam_access for this:

# /etc/pam.d/system-auth
account     required

Then control who has access as follows:

# /etc/security/access.conf
+ : root otheruser : ALL
- : ALL : ALL
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.