Take the 2-minute tour ×

We are writing an application (perl, mysql) that will run headless on a *nix (likely CENTOS).

How can I setup/secure the local user/password for the account 'app' (where the app will be running) so that,

  • a remote ssh-login is not possible
    ssh is working, so are logins for all accounts, but I need to secure this single account
  • a 'su app' works for users with existing accounts

What is such a setup called? I'm certainly not the first one to try this, it must be documented many times, but I fail to find the relevant search terms for Google.

EDIT: Solution

I added the lines:

# prevent certain users from using ssh for login
# while retaining the option to 'su username'
DenyUsers app

to /etc/ssh/sshd_config

then restartet sshd using

service sshd restart

I can now login as 'user' over ssh and 'su app' to work as app.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

put all users into a group 'remote_users' and specify in your sshd.conf, that only users from that groups are allowed to login via ssh:


         This keyword can be followed by a list of group name patterns,
         separated by spaces.  If specified, login is allowed only for
         users whose primary group or supplementary group list matches one
         of the patterns.  Only group names are valid; a numerical group
         groups.  The allow/deny directives are processed in the following
         order: DenyUsers, AllowUsers, DenyGroups, and finally
share|improve this answer
setting the login shell to /bin/false prevents a local user from bein able to 'su app' or 'su - app' –  lexu Oct 27 '09 at 9:51
just as a side question: why should users be do this 'su app' anyway? –  akira Oct 27 '09 at 9:53
Why cannot one simply forbid the "app" group/user forbid to login in via sshd.conf? –  foraidt Oct 27 '09 at 9:57
@akira: not all users, just some. They need to edit crontable, change config files, run jobs etc that depend on the 'app' user's credentials. We don't want them to login as 'app', so they feel the system can identidy them => keep the guilty out of trouble. –  lexu Oct 27 '09 at 10:48
@mxp and @akira: I'll look into the possibilities of sshd.cond, thx –  lexu Oct 27 '09 at 10:49
show 2 more comments

If you are using openssh keys to login via ssh, you could simply disallow password logins for all accounts. suing would still be possible.

share|improve this answer
This was considered, but denied, since the users might not always have the ssh keys with them (my arguing that a login to home-server, then ssh-ing to the app-target, didn't penetrate/was deemed to complex) –  lexu Oct 27 '09 at 11:17
OK. Technically still a possibility though. –  innaM Oct 27 '09 at 11:54
add comment

Your Answer


