How To Allow Or Deny SSH Access To A Particular User Or Group In Linux

This brief guide will walk you though the steps to allow or deny SSH access to a particular user or a group in Linux and Unix operating systems.

We will also learn how to disable SSH root login in Linux. Disabling SSH root login enhances security by mitigating the risk of brute force attacks against the root account, which, if compromised, grants full control over the system.

Introduction

A while ago, we discussed how to limit a user's access to Linux system using Restricted shell. Once we have put the users in restricted mode, they can't do anything except what they are allowed to do.

It will be helpful when you want to allow a particular user to execute only a specific set of commands.

In this article, we are going to enable or disable SSH access for an user or group by making a few changes in SSH default configuration file.

Allow or Deny SSH Access to a Particular User or Group in Linux

The openSSH default configuration file has two directives for allowing and denying SSH access to a particular user(s) or a group.

First, let us see how to allow or enable SSH access to an user and group. Please note that all commands given below should be run as root or sudo user.

1. Allow SSH Access to a User or Group

To allow SSH access for a particular user, for example sk, edit /etc/ssh/sshd_config file:

$ sudo vi /etc/ssh/sshd_config

Press "i" to enter into insert mode and add or modify the following line:

AllowUsers sk

Replace "sk" with your username. Please mind the space indentation between "AllowUsers" and "sk". You should use Tab instead of Space-bar. Meaning - add the word "AllowUsers" and hit the Tab key and then specify the username.

You can also specify more than one user as shown below.

AllowUsers user1 user2

To allow SSH access for an entire group, say for example root, add/edit the following line:

AllowGroups root

This setting will allow all the members of the "root" group to ssh to the Linux server.

Press ESC key to exit insert mode and type :wq to save and quit the SSH config file. Restart SSH service to take effect the changes.

$ sudo systemctl restart sshd

Now, the user sk and all the members of the "root" group are allowed to ssh into your Linux server. The other users (except sk and members of "root" group) are not allowed to access the system via ssh.

To verify it, try to ssh into the Linux server as any one of the non-allowed user:

$ ssh ostechnix@192.168.225.52

You will get the following error message:

ostechnix@192.168.225.52's password: 
Permission denied, please try again.

2. Deny SSH Access to a User or Group

To disable or deny SSH access to an user or group, you need to add/modify the following directives in your remote server's /etc/ssh/sshd_config file.

1. DenyUsers
2. DenyGroups

To deny SSH access to specific user called "sk", edit /etc/ssh/sshd_config file:

$ sudo vi /etc/ssh/sshd_config

Add/edit the following line:

DenyUsers sk

Make sure the space indention is correct. Don't use Space-bar. Press Tab key and add the username.

Similarly, to deny SSH access to multiple users, specify the usernames with space separated as shown below.

DenyUsers user1 user2

Likewise, to deny SSH access to an entire group, for example root, add:

DenyGroups root

Save and quit the ssh config file. Restart ssh service to take effect the changes.

$ sudo systemctl restart sshd

Now try to ssh to your Linux machine from blocked user account, for example sk:

$ ssh sk@192.168.225.52

You will get the following message:

sk@192.168.225.52's password: 
Permission denied, please try again.
sk@192.168.225.52's password:

3. Disable SSH Root Login

Root ssh access is considered a bad practice in terms of security. So it is strongly recommended to disable SSH Root user login to secure your system.

To disable root ssh login, edit /etc/ssh/sshd_config file:

$ sudo vi /etc/ssh/sshd_config

Find the following line, Uncomment it, and set the value to no.

PermitRootLogin no

Restart SSH service to take effect the changes immediately:

$ sudo systemctl restart sshd

Conclusion

You know now how to grant and restrict SSH access to certain user(s) or a group in Linux. You also learned how to deny or disable SSH root login in Linux. It is one of recommended security practice every Linux admin should implement when setting up a Linux server.