0

How can I configure sshd so I permit only key-based access for select users? Besides a root user, I would like restrict a specific user.

1
  • 2
    You can use the Match directive in openssh sshd_config to set policies for specific (groups of) users
    – Bob
    Sep 18, 2020 at 16:45

1 Answer 1

0

You are really asking two questions - I'm going to focus on the less common

Restricting users:

I assume there are more users then the ones who are allowed to login but these other users are given accounts for non-ssh use. There are more than one way to skin that cat - but this is what I like to do:

  • Create a new group login (sudo groupadd login).
  • Add your select users to the login group (sudo usermod -a -G login someuser).
  • Create /etc/ssh/sshd_config.d/80-login-group-or-noshell.conf
# The few people who need shell access on this host are added to the
# login group, otherwise - keep out!
Match Group *,!login
    ForceCommand /usr/sbin/nologin

This assumes that the version is recent and the installed sshd_config ends in Include /etc/ssh/sshd_config.d/*.conf. OF course you can just paste that into your sshd_config but thats not as clean.

Locking down for only-keybased log-ins

I'm pretty sure that this is the default in the systems I typically install (F32). SO no need to do anything except for maybe trying to connect with your pblic keys temporarily removed in the server. Pretty sure the config you are looking for is PasswordAuthentication no.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .