Re: user selection for ssh connections

From: Matthew Palmer (mjp16@ieee.uow.edu.au)
Date: 11/29/01 

Date: Thu, 29 Nov 2001 12:39:30 +1100 (EST)
From: Matthew Palmer <mjp16@ieee.uow.edu.au>
To: "james d. butler" <jamesDB@rocketmail.com>
Subject: Re: user selection for ssh connections
Message-ID: <Pine.LNX.4.10.10111291236140.16614-100000@anode.ieee.uow.edu.au>

On Tue, 27 Nov 2001, james d. butler wrote:

> Is it possible to exclude individual users from connecting via
> SSH? I'd like to have a list of users that are allowed to
> connect and a list of those that are not. Can it be done? If
> so, how?

Defining your system would help - I have no idea how to do it under Windows,
for instance...

But, for any system in which SSH uses PAM, you can use the pam_access.so
module, and modify /etc/security/access.conf to do something like:

+:joe mary foo:ALL

-:baduser baduser2:ALL

That'll let joe, mary, and foo on, and not let baduser or baduser2 on.
It'll let anyone else on, because if the person isn't found in there it
assumes access is granted. If you want default-deny,

-:ALL:ALL

will give you that, if put AT THE BOTTOM OF THE FILE.

Works for me on a Debian Linux system, and I would presume anything else
which uses an equivalent pam_access.so.

The module could be a lot smarter, but it's better than nowt. 

-- 
-----------------------------------------------------------------------
#include <disclaimer.h>
Matthew Palmer
mjp16@ieee.uow.edu.au

Relevant Pages

  • Re: Problem with firewall and SSH port forwarding
    ... CG> I'm trying to restrict access to my machine by restricting the IP ... CG> addresses from which outside ssh connections can be made. ... CG> The 'client' is trying to do the following:- ...
    (comp.security.ssh)
  • Re: first ssh, then start copying
    ... > MW> look at what files I have on a remote server, then exit, ... > (ssh, scp, sftp, etc.), and these programs do not cooperate to share ... So there's constant creation of new SSH connections, ... Hi Richard! ...
    (comp.security.ssh)
  • Re: who does session disconnects
    ... Are you asking if a SSH connection from a SSH client ... is your question then your answer is that the SSH client and SSH server ... must support SSH connections. ... Enter this command to perform a one time generation of RSA keys to be used ...
    (comp.dcom.sys.cisco)
  • Re: user selection for ssh connections
    ... user selection for ssh connections ... >Is it possible to exclude individual users from connecting via ... via SSH using the DenyUsers parameter in the SSH daemon configuration file ...
    (Focus-Linux)
  • Re: Using SSH over SSL
    ... > I'm wanting to do some performance tests using unencrypted SSH ... > connections over SSL Vs. SSH connections using the built in ciphers. ...
    (comp.security.ssh)