How do i disable remote access for non-root users over ssh? i would like to do this on demand if possible.
Can use PAM as well:
cp /etc/security/access.conf /etc/security/sshd.conf
echo "+ : root : ALL" >> /etc/security/sshd.conf
echo "- : ALL : ALL" >> /etc/security/sshd.conf
Then modify /etc/pam.d/sshd to add the following line after the other accounts:
account required pam_access.so accessfile=/etc/security/sshd.conf
This will also allow you to restrict by network if you decide to do so in the future.
If you want it to be on-demand, the standard way is to use
/etc/nologin (have a look at
man 5 nologin).
Creating this file (with an optional message inside) will deny non-admin logins and display the message instead; removing the file will allow logins back.
It can be applied to ssh, local logins, and anything else that uses PAM; just make sure that
the PAM configuration for the service requires
pam_nologin.so. (It does by default for ssh and console logins on many distributions)