Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to conditionally disable interactive logins in ubuntu in the event that a user attempts to login to an ssh shell with an invalid username.

Say I have a user 'bob' on my server, but the user 'fred; is not a valid user.

When bob logs in with

ssh bob@my_ip_address

I want an interactive login

When someone signs in with

ssh fred@my_ip_address

I don't want any interactive login and the login attempt to terminate.

How can one do this in Ubuntu?

share|improve this question

migrated from stackoverflow.com Sep 15 '11 at 6:56

This question came from our site for professional and enthusiast programmers.

2  
I would strongly discourage you from doing this. It's basically one step away from a SSH user-selection list. –  Blender Sep 15 '11 at 4:16
2  
You should use keys and eliminate the interactive logins altougher. Also, you will probably get more responses on serverfault. –  joet3ch Sep 15 '11 at 4:53
add comment

3 Answers

You really don't want to do this. OTOH, fail2ban does just about exactly what you want. You can set it up to detect and ban IPs that attempt login as an invalid user for a certain period of time.

joet3ch is also correct in saying switching to public-private key login only would be the most secure.

share|improve this answer
add comment

Do you realize that this way it would be very easy to find a valid username? You always want any attacker to have as little information about your system as possible!
As an alternative to fail2ban, you could also use denyhosts looks like it would do the exact same as fail2ban.

share|improve this answer
add comment

In /etc/ssh/sshd_config, you can use the AllowUsers parameter to specify which users are allowed to login via SSH:

AllowUsers
             This keyword can be followed by a list of user name patterns, separated by spaces.  If specified, login is allowed only for user names that match one of the patterns.  Only
             user names are valid; a numerical user ID is not recognized.  By default, login is allowed for all users.  If the pattern takes the form USER@HOST then USER and HOST are
             separately checked, restricting logins to particular users from particular hosts.  The allow/deny directives are processed in the following order: DenyUsers, AllowUsers,
             DenyGroups, and finally AllowGroups.

             See PATTERNS in ssh_config(5) for more information on patterns.

Also, I'd really recommend using SSH keys instead of passwords to secure the connections.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.