Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Redhat 4/5:

Ok so here's the deal. I need to lock down my servers and only allow users to log in via their ldap account. There's an application account that everyone uses, but I would rather have them use their LDAP account and then sudo over to the app user. I got that part, however, there are components with our app that requires the app user to have keyless ssh. Wouldn't make sense to allow some users direct logon w/ the app user while others require LDAP.

In my sshd_config file I would set

DenyUser appuser
share|improve this question

If you set DenyUsers appuser then appuser can't log in, using keys or otherwise: Their login will be denied.

What you probably want to do is lock out appuser's password and give that user a new SSH key that nobody has access to - Now nobody can log in as appuser unless they have the new SSH key, which would only be given to the components that need passwordless SSH access. Everyone else can log in with their LDAP account and sudo to do whatever they need to do, which it sounds like you already have working.

share|improve this answer
Oh man, why didnt I think of that. I'll just set appuser's password to blank or something. PAM should deny access by default due to no password (I think). – luckytaxi Jan 20 '11 at 23:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.