How can I configure sshd
so I permit only key-based access for select users? Besides a root user, I would like restrict a specific user.
1 Answer
You are really asking two questions - I'm going to focus on the less common
Restricting users:
I assume there are more users then the ones who are allowed to login but these other users are given accounts for non-ssh use. There are more than one way to skin that cat - but this is what I like to do:
- Create a new group
login
(sudo groupadd login
). - Add your select users to the
login
group (sudo usermod -a -G login someuser
). - Create
/etc/ssh/sshd_config.d/80-login-group-or-noshell.conf
# The few people who need shell access on this host are added to the
# login group, otherwise - keep out!
Match Group *,!login
ForceCommand /usr/sbin/nologin
This assumes that the version is recent and the installed sshd_config
ends in Include /etc/ssh/sshd_config.d/*.conf
. OF course you can just paste that into your sshd_config
but thats not as clean.
Locking down for only-keybased log-ins
I'm pretty sure that this is the default in the systems I typically install (F32). SO no need to do anything except for maybe trying to connect with your pblic keys temporarily removed in the server. Pretty sure the config you are looking for is PasswordAuthentication no
.