如何关闭本地用户的ssh登录让其却可以在vsftpd 的chroot 设置用户里登录

13251947

Debian下

如果这样添加用户
useradd username -s /bin/false
则两个服务都登录不了

useradd username -s /usr/sbin/nologin
也是一样的效果

不知道要怎么设置这个

vermouth

useradd 是添加用户的命令；
-s 定义该用户启动时分配的 shell，如果是 false nologin 这些不是 shell 的命令或者 /abc/def 一类不存在的文件，用户自然没有 shell 使用，以至于不能登陆了。

13251947

我用这个半反在RH下可以 debian 想要加一个用户给ftp 但不给ssh 还是没有办法

vermouth

可以修改 passwd 啊，ssh 的话不是有 sshd.conf 和 hosts.deny 限制么。

carrison

http://www.cyberciti.biz/tips/li ... he-sshd-server.html

Linux PAM configuration that allows or deny login via the sshd server
Open SSH Logo

The idea is very simple you want to limit who can use sshd based on a list of users. The text file contains a list of users that may not log in (or allowed to log in) using the SSH server. This is used for improving security.

PAM (Pluggable authentication modules) allows you to define flexible mechanism for authenticating users. My previous post demonstrated how to deny or allow users using sshd configuration option. However, if you want to block or deny a large number of users, use PAM configuration.
A note for new sys admins

   1. Backup all data and PAM configuration files before any modification
   2. Please be careful to perform the configuration option. Wrong configuration can lock down all login access including root access.
   3. Read this Linux-PAM configuration file syntax guide
   4. Now continue reading below for pam_listfile.so configration...

Use of pam_listfile.so module

This PAM module authenticates users based on the contents of a specified file. For example, if username exists in a file /etc/sshd/ssh.allow, sshd will grant login access.
How do I configure pam_listfile.so module to deny access?

You want to block a user, if user-name exists in a file /etc/sshd/sshd.deny file.

Open /etc/pam.d/ssh (or /etc/pam.d/sshd for RedHat and friends)
# vi /etc/pam.d/ssh

Append following line:
auth required pam_listfile.so item=user sense=deny file=/etc/sshd/sshd.deny onerr=succeed

Save and close the file

Now add all usernames to /etc/sshd/sshd.deny file. Now a user is denied to login via sshd if they are listed in this file:
# vi /etc/sshd/sshd.deny

Append username per line:
user1
user2
...

Restart sshd service:
# /etc/init.d/sshd restart

Understanding the config directives:

    * auth required pam_listfile.so : Name of module required while authenticating users.
    * item=user : Check the username
    * sense=deny : Deny user if existing in specified file
    * file=/etc/sshd/sshd.deny : Name of file which contains the list of user (one user per line)
    * onerr=succeed : If an error is encountered PAM will return status PAM_SUCCESS.

How do I configure pam_listfile.so module to allow access?

You want to ALLOW a user to use ssh, if user-name exists in a file /etc/sshd/sshd.allow file.
Open /etc/pam.d/ssh (or /etc/pam.d/sshd for RedHat and friends)
# vi /etc/pam.d/ssh

Append following line:
auth required pam_listfile.so item=user sense=allow file=/etc/sshd/sshd.allow onerr=fail

Save and close the file.

Now add all usernames to /etc/sshd/sshd.allow file. Now a user is allowed to login via sshd if they are listed in this file.
# vi /etc/sshd/sshd.allow

Append username per line:
tony
om
rocky

Restart sshd service (optional):
# /etc/init.d/sshd restart

Now if paul try to login using ssh he will get an error:
Permission denied (publickey,keyboard-interactive).

Following log entry recorded into my log file (/var/log/secure or /var/log/auth.log file)
tail -f /var/log/auth.log

Output:

Jul 30 23:07:40 p5www2 sshd[12611]: PAM-listfile: Refused user paul for service ssh
Jul 30 23:07:42 p5www2 sshd[12606]: error: PAM: Authentication failure for paul from 125.12.xx.xx

Understanding the config directives:

    * auth required pam_listfile.so : Name of module required while authenticating users.
    * item=user : Check or specify the username
    * sense=allow : Allow user if existing in specified file
    * file=/etc/sshd/sshd.allow : Name of file which contains the list of user (one user per line)
    * onerr=fail : If filename does not exists or username formatting is not coreect it will not allow to login.

13251947

谢谢，我试一下

rhlei

sshd_conf 中有  DenyUser选项。

kns1024wh

那个实际上是通shell限制用户登陆
具体还是建议通过denyuser限制ssh的使用 通过vsftpd的限制ftp的访问