LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Only allow root ssh access to the server (https://www.linuxquestions.org/questions/linux-security-4/only-allow-root-ssh-access-to-the-server-789782/)

replica88 02-17-2010 01:59 PM

Only allow root ssh access to the server
 
When creating 10 samba users I also created Linux users. I do not want these Samba users to be able to use putty, winscp etc to access the server.

Do you know how I can restrict ssh access to specific users?

Web31337 02-17-2010 02:01 PM

DenyUsers? or, better AllowUsers?
man sshd_config
Anyway, why would you need root access to ssh? isn't it better to allow one user to access ssh and then use sudo/su when need root access?

anomie 02-17-2010 02:46 PM

Alternatively (or additionally), you could give the samba users nologin shells.

# chsh -s /sbin/nologin user_here

I don't use samba, but I don't see why a valid shell would be required. (However, if I am mistaken, then my advice is wrong. ;))

deadeyes 02-19-2010 05:30 AM

Quote:

Originally Posted by anomie (Post 3867311)
Alternatively (or additionally), you could give the samba users nologin shells.

# chsh -s /sbin/nologin user_here

I don't use samba, but I don't see why a valid shell would be required. (However, if I am mistaken, then my advice is wrong. ;))

This is the way to go if your concerns are the samba users only.
If you dont want any other user then root, use Allow/DenyUsers

Also, when you create a samba user, it does need a system user.
BUT (and this is important to know) you do not need to set a password on the system user account.
This automatically does deny ssh access as empty password logins are denied by ssh.

cantab 02-19-2010 06:46 AM

Bear in mind setting the shell to nologin does not prevent non-shell ssh access, like portforwarding. And there's a nice little DoS using that. To block ALL types of ssh access, you need to use Allow/Deny users

And you should not allow root ssh logins. If you allow root logins, an attacker need only guess the root password. You should allow a user to login to ssh, and then su to root. And make the root password different to the user's password. That way, an attacker has to guess a username, a user password, and a root password.

deadeyes 02-20-2010 04:48 AM

Quote:

Originally Posted by cantab (Post 3869295)
Bear in mind setting the shell to nologin does not prevent non-shell ssh access, like portforwarding. And there's a nice little DoS using that. To block ALL types of ssh access, you need to use Allow/Deny users

And you should not allow root ssh logins. If you allow root logins, an attacker need only guess the root password. You should allow a user to login to ssh, and then su to root. And make the root password different to the user's password. That way, an attacker has to guess a username, a user password, and a root password.

Yes, forgot to mention the non shell ssh access :) (-N option). Good you mentioned that!

replica88 02-20-2010 08:36 AM

Thanks guys, good advice. I've changed my approach, now only one user account has ssh access and has to su to root.


All times are GMT -5. The time now is 03:13 PM.