deney access to specific users with ssh

[Ratzie]

We are trying to lock down our system and with that, we have started using ssh.

How do we disable ssh login for specific users...

[Steven E. Protter]

passwd -l username

or

/var/adm/inetd.sec

You should be able to block by username there.

SEP

[Joseph Loo]

Hi,

inetd.sec allows you to deny access to the hostname/s or ip address/es of the workstations.

# ssh deny/allow [ip or range of ip]
# ssh deny/allow [hostname/s]

In fact, I would also like to know how to disable certain services to specific user.

regards.

[Ratzie]

I found the answer.
In sshd_config

DenyUsers

[Todd McDaniel_1]

Another effective way is to use /etc/hosts.allow... and /etc/hosts.deny...

You can configure it to only allow ranges and only certain IPs...

here is a great link to it.


http://ezine.daemonnews.org/200206/hosts_allow.html


Shows full syntax and application.


Be sure to put any "deny" statements ahead of an "allow all" statements... in the /etc/hosts.allow file...

sshd : all : banners=/usr/localcw/opt/sysguard/banners : allow

In deny file, deny all:all. Use the hosts.allow to manage services as I have in my example.


# cat /etc/hosts.allow
#all : all : banners=/usr/localcw/opt/sysguard/banners : allow
ftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
telnetd : all : banners=/usr/localcw/opt/sysguard/banners : allow
tftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
logind : all : banners=/usr/localcw/opt/sysguard/banners : allow
rlogind : all : banners=/usr/localcw/opt/sysguard/banners : allow
remshd: all : banners=/usr/localcw/opt/sysguard/banners : allow
sidftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
rexecd : all : banners=/usr/localcw/opt/sysguard/banners : allow
sshd : all : banners=/usr/localcw/opt/sysguard/banners : allow