Date: Fri, 8 Oct 2004 18:18:12 +0200 From: Jeremie Le Hen <jeremie@le-hen.org> To: Jim Hatfield <subscriber@insignia.com> Cc: freebsd-security@freebsd.org Subject: Re: Question restricting ssh access for some users only Message-ID: <20041008161812.GC806@obiwan.tataz.chchile.org> In-Reply-To: <kp8dm054h3kcnm4chrm2gupsmospi6cnai@4ax.com> References: <3203DF3DDE57D411AFF4009027B8C36760563C@exchange-uk.isltd.insignia.com> <kp8dm054h3kcnm4chrm2gupsmospi6cnai@4ax.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> >have you tried using /etc/login.access?
>
> Hmm, looks like sshd does not consult this file!
login.conf(5) is indeed the configuration file for login(1) which is
not used sshd(8) with the default configuration. You have to use the
`UseLogin' option described in sshd_config(5) :
UseLogin
Specifies whether login(1) is used for interactive login ses-
sions. The default is ``no''. Note that login(1) is never used
for remote command execution. Note also, that if this is
enabled, X11Forwarding will be disabled because login(1) does not
know how to handle xauth(1) cookies. If UsePrivilegeSeparation
is specified, it will be disabled after authentication.
Apart from that, `AllowUsers' and `AllowGroups' have been mentioned
multiple times, but it might be easier to use `DenyUsers' and
`DenyGroups' options for the described situation.
Regards,
--
Jeremie Le Hen
jeremie@le-hen.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041008161812.GC806>