SSH Access Control: Restricting User Login with AllowUsers Directive

Core Mechanisms of SSH Access Control

In Linux systems, SSH (Secure Shell) is the standard protocol for remote server management, but its default configuration may allow excessive user access, increasing security risks. When system administrators detect external brute-force attempts, one of the primary tasks is to precisely control which users can log in via SSH.

The AllowUsers Directive in /etc/ssh/sshd_config

The SSH server configuration file /etc/ssh/sshd_config provides the AllowUsers directive, which is the most direct and effective method for restricting SSH access. This directive allows system administrators to explicitly specify the list of permitted users, while all other users are automatically denied.

Configuration example:

AllowUsers boris

The above configuration means only user boris can log in via SSH. If multiple users need to be allowed, separate them with spaces:

AllowUsers boris alice admin

Configuration Implementation Steps

1. Open the SSH configuration file with a text editor: sudo nano /etc/ssh/sshd_config
2. Add the AllowUsers directive at an appropriate location in the file, specifying the permitted usernames
3. Save the file and exit the editor
4. Restart the SSH service to apply the configuration: sudo systemctl restart sshd
5. Verify the configuration is correctly applied: sudo sshd -t

Security Enhancement Measures

In addition to using the AllowUsers directive, other security measures can be combined:

Public Key Authentication: Disabling password authentication and switching to public key authentication can significantly improve security. Install the public key in the target user's ~/.ssh/authorized_keys file and ensure the private key is protected with a strong passphrase.

Port Modification: Changing the SSH service from the default port 22 to another port (e.g., 3456), while not directly enhancing security, effectively reduces scanning attempts by automated scripts and bots, thereby cleaning up system logs.

Relationship Between User Shell and Login Capability

It is important to note that not all users listed in the /etc/passwd file can log in via SSH. Only those with valid shells (such as /bin/bash or /bin/sh) have login capability. System users typically use /usr/sbin/nologin or /bin/false as their shell, preventing SSH login.

Users with login shells can be viewed with the following command:

grep -E "/(bash|sh|zsh|tcsh|csh|ksh)$" /etc/passwd

Comprehensive Security Strategy

Best practices recommend adopting a layered security strategy:

1. Use AllowUsers to strictly restrict login-capable users
2. Enable public key authentication and disable password authentication
3. Change the default SSH port
4. Configure failed login attempt limits (e.g., using fail2ban)
5. Regularly review authentication logs (/var/log/auth.log or /var/log/secure)

Through these measures, system administrators can establish a secure and manageable SSH access environment, effectively defending against brute-force attacks while ensuring normal access for authorized users.