Is there a command to allow / deny users in OpenSSH server (sshd)?

I know you can add AllowUser / DenyUser in the sshd_config and reload the server but I'm trying to come up with a generic way that will work for any linux distribution. The reload commands (and possibly the config file location) differ from distro to distro.


You can use DenyGroups and/or AllowGroups to restrict access based on the groups that users are members of. That would just require you to update sshd_config & restart sshd once when specifying the group(s). Then it's just a matter of adding users to one group or the other.

  • Thanks for the advice but it is for a control panel that adds new users and groups. – Devon Jun 26 '14 at 20:31
  • You should have mentioned that in the original question. But in any event, DenyGroups could still work. It's just a matter of adding users to the appropriate groups, so if your control panel is already managing groups it's just one more group to manage. It would be as simple as having a dedicated group like "nossh" and then calling "usermod -G nossh" to deny access to ssh. – Bruce P Jun 26 '14 at 20:34

I don't think there is a generic way.

However, you could make symbolic links so that /etc/ssh/sshd_config points to the sshd configuration file in all your systems.

Then, you can kill -SIGHUP sshd. make a symbolic link from wherever the pid file is to /run/sshd.pid and kill -SIGHUP $(cat /run/sshd.pid)

(To make symbolic links, ln -s /full/path/to/target /path/to/symlink)

I wouldn't recommend doing anything of the above, but I'm just telling you how you can achieve what you want.

  • Yeah, that would require more work than I wanted. I wanted it to be more drop-in for any linux. Right now I just look for common places for the sshd_config and the init. That may be the best way to handle this but the way I have it configured, it will only work for the locations I specify. – Devon Jun 26 '14 at 20:33
  • 1
    Then, maybe you need to use defensive programming: Try each possible path to sshd_config, then, when found, update the config. Then, try each possible path to the sshd pid file and when you find it, use it to send SIGHUP to the pid. – moebius_eye Jun 26 '14 at 20:35

you can do one thing.

create RSA keys for the users you want to allow and then deny all users and allow only those user which have the RSA key or those whose public keys are inside your


In this way you accomplish two things

1) No need to use passwords again and during login thus no shoulder surfing and no threat 2) Unauthorized access is completely denied.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.