How to dynamically restrict SSH access to a given user

Question

The goal here is to create a script to easily manage reservation for a machine. When a user reserve the machine, it should be the only one able to access the machine for a given time (except admins of course).

I already found a solution with PAM. This single line in /etc/pam.d/sshd would have resolve my problem:

auth required pam_listfile.so item=user sense=allow file=/etc/ssh/sshd.allow onerr=fail

with the user login in /etc/ssh/sshd.allow

But it does not work at all:

$ cat /etc/ssh/sshd.allow 
foo

$ tail -f /var/log/auth.log
Dec  1 12:12:05 mini sshd[2697]: Accepted publickey for bar from 192.168.0.11 port 58087 ssh2
Dec  1 12:12:05 mini sshd[2697]: pam_unix(sshd:session): session opened for user bar by (uid=0)

Here the /etc/pam.d/sshd file

# PAM configuration for the Secure Shell service
auth       required     pam_env.so # [1]
auth       required     pam_env.so envfile=/etc/default/locale
auth required pam_listfile.so item=user sense=allow file=/etc/ssh/sshd.allow onerr=fail
@include common-auth
account    required     pam_nologin.so
@include common-account
@include common-session
session    optional     pam_motd.so # [1]
session    optional     pam_mail.so standard noenv # [1]
session    required     pam_limits.so
@include common-password

I am running a Debian Squeeze box, I don't know if the behaviour of PAM is different with this.

Answer 1

Similar idea to above: Could you use AllowGroups in sshd.conf to allow a specific group (+ a group for admins), then add and remove users from the group using your authentication system, preventing you from having to edit files at all, or at least only edit files with well established interfaces (/etc/group via usermod etc).

Answer 2

Why you didnt use in /etc/ssh/sshd_config in section AllowUsers user1 user2 user3

Answer 3

You can very easily use pam_access for this:

# /etc/pam.d/system-auth
account     required      pam_access.so

Then control who has access as follows:

# /etc/security/access.conf
+ : root otheruser : ALL
- : ALL : ALL