I can currently login to my server via ssh as root. There may be some other users, however, that have ssh access. I want to block out any possible logins except from root. How can I do this?



So you can achieve your stated desire with the AllowUsers directive in your sshd_config file, for example:

$ grep AllowUsers /etc/ssh/sshd_config
AllowUsers root

However I would be wary of using the root account for ssh - consider instead an unprivileged account for normal use, using something like sudo to acquire root privileges only when needed.

| improve this answer | |

From man sshd_config

         This keyword can be followed by a list of user name patterns, separated
         by spaces.  If specified, login is allowed only for user names that match
         one of the patterns.  Only user names are valid; a numerical user ID is
         not recognized.  By default, login is allowed for all users.  If the pat‐
         tern takes the form USER@HOST then USER and HOST are separately checked,
         restricting logins to particular users from particular hosts.  The
         allow/deny directives are processed in the following order: DenyUsers,
         AllowUsers, DenyGroups, and finally AllowGroups.

         See PATTERNS in ssh_config(5) for more information on patterns.

Btw. please don't allow passwords login for your root user. Only allow ssh keys or even better just allow a specific user to login and change to root but not root directly.

| improve this answer | |
  • hey, thx for the answers so far. Does it matter where in the file I put AllowUsers root? Also, out of curiosityk, why is logging as as some other users and sudo-ing to root more secure than logging in as root? – Jonah Sep 8 '11 at 0:40
  • It does not matter. If you just allow ssh keys there should be no problem but there was for example a bug in ssh-keygen in debian which produced guessable ssh-keys. This would allow an easy access to your system just with some simple bruteforce. In general it is always a good idea to do privilege separation and run as less commands as possible with administrative privileges. – Ulrich Dangel Sep 8 '11 at 0:47
  • thx mru, i upvoted you but accepted the other answer cause it had the exact line i needed. – Jonah Sep 8 '11 at 2:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.