Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to create a webapp (Apache/PHP) which act as a webportal for people who need to connect via SSH on severals servers. One just go to the portal, authentify himself, and ask to open SSH access. From now, he can connect with his favorite SSH client, and can stop the session on the webapp. All servers are Debian Lenny or Squeeze, and we already connect to them throught a SSH proxy. On this proxy, there is a file /etc/ssh/sshd_config

AllowUsers user1@192.168.1.* user2@192.168.1.* 
AllowUsers user3@192.168.1.*

How can I allow or disallow a user from my webapp? An easier way than rewriting this file and restarting opensshd?

share|improve this question
We have found a way to do it via PAM wich allow to call a script, and the script answer is the user have the right to connect. We are trying to implement the whole thing. – Cédric Girard May 21 '12 at 12:06

Instead of AllowUsers, use something like AllowGroups sshaccess.

Then you can have your web app add that user to the sshaccess group and they'll be able to authenticate. This won't require you to bounce sshd with each change like it would with AllowUsers.

You'll get bonus points for implementing LDAP for authentication - this both makes it very easy to programmatically manage users and groups as well as allowing you to maintain one central user database that multiple servers can refer to.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.