I am planing to upgrade a server that have some SSH and rsync(over ssh) users. During this time that I am upgrading the server I don't want anyone else to login to the server.

Is there a way for me to block all SSH logins except for the user "nisse", and print a banner to the other users informing them of the temporary block because of upgrade?

My first plan was to change the default banner and then just remove the users from "AllowUsers" but I was thinking if there is a better way?

  • Why do you wish not to block the user nisse? It's this requirement that makes an answer difficult. – MadHatter Apr 24 '14 at 7:16
  • 1
    This seems just like the perfect use case for AllowUsers/AllowGroups. What benefits are you hoping to find by taking another route? – andol Apr 24 '14 at 7:26

In the absence of any reply to the above queries, I'll have to make an assumption: specifically, that you wish to continue to allow the nisse user to log in to assist with the rsync.

This is the requirement that's complicating your usage case, and it's indicative of a poor requirement. The usual method of stopping further users from logging in is to touch /etc/nologin; in addition, anything you put into that file will be printed as a rejection banner. This will stop connections via ssh, sftp, and rsync -e ssh. It won't log out any current users, so if you're worried about nisse being thrown off before launching the rsync, don't be. rm /etc/nologin once you're done.

If the issue is that nisse must log in after the ban is in place, as part of the rsync, you're doing the rsync backwards. Log in, create /etc/nologin, then use rsync to push from the current server, instead of pulling from the new one.

If there is some other business-critical reason for nisse's exception that I haven't covered, then andol is right when (s)he points out above that modifying your current AllowUsers settings is pretty much the perfect way to achieve the granularity you require. While you're there, you can further modify your sshd_config to use Banner to print a banner before rejection, and nisse can be told to ignore it.

  • nisse is my admin(su) user that I will be using to access the server during the upgrade. The problem is that I want to block all other users to use SSH except my self because I will do the server upgrade via SSH. I didn't know about the nologin file, I will read up on it. – Sun_Blood Apr 24 '14 at 11:33
  • As long as you're logged in before you put that file in place - and how else would you put it there? - it will have no effect on your current login. – MadHatter Apr 24 '14 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.