Comments on 2018-11-11 ssh config

One thing I like to do is to configure a group, which a user has to be in, to be allowed to ssh in. So the default is that a user can’t.

This avoids e.g. the problem where you create a dummy user with a weak password to test something, and forget to delete the user. Not that I’ve ever done that. Noooo.

I’ve split the users allowed to ssh in up into “sshusers” and “sshkeyusers”, the first category is allowed to use a password (basically, me), and the second category can only login with a key (the handful of friends that have access). In /etc/ssh/sshd_config I have:

# Only allow sshusers/sshkeyusers to ssh in:
AllowGroups sshusers sshkeyusers
Match Group sshkeyusers
  PasswordAuthentication no

Adam 2018-11-11 15:22 UTC

Hahaha! 😎

Luckily, that server should only have me on it. But you’re right. Better be safe than sorry!

– Alex Schroeder 2018-11-11 18:32 UTC

I currently have the following:

# List of user names allowed to log in.
# We need root for our backup script.
# We need git for git-via-SSH repos.
AllowUsers alex git root

PermitRootLogin prohibit-password

So let me think this through:

  1. I want alex to connect using a password just in case.
  2. I don’t want git to connect using a password (not sure why it seems to have a password in /etc/shadow and /usr/bin/git-shell as its shell in /etc/passwd and I don’t know whether any of these obviate a setting in /etc/sshd_config) 🤔❓
  3. I don’t want root to connect using a password.

So I added the following:

Match User git
    PasswordAuthentication no

Seems to work as intended, for now.

– Alex Schroeder 2018-11-12 13:26 UTC

“The rage that one felt was an abstract, undirected emotion which could be switched from one object to another like the flame of a blowlamp.” – George Orwell, 1984, chapter 1

– Alex Schroeder 2018-11-12 13:30 UTC

Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit this page if you need to fix typos. You can subscribe to updates by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.