4

I want to "block/restrict" one of the accounts on my dedicated server, but I want user to allow to log in, then i want the message to pop up for him (for example in putty) and then close connection (so the putty window will be up and he can read it, but he can't do/type anything in console).

I remember that in the old days i was doing something like that on freebsd, but kinda can't find any useful informations about how to approach this problem.

Any help?

Eska
  • 495

2 Answers2

4

1. Edit /etc/ssh/sshd_config and add these directives at the bottom:

Match User guest
    Banner /etc/ssh/banner_guest
    DenyUsers guest
Match all
  • Change guest with the actual username.

2. Create the banner file: sudo nano /etc/ssh/banner_guest, and type your message inside, for example:

+------------------+
| Get out of here! |
+------------------+

3. Restart the SSH server:

sudo systemctl restart ssh.service

The result would be:

enter image description here

enter image description here

EDIT:

Please note regardless in the above example PubkeyAuthentication is available and there is a valid /home/guest/.ssh/authorized_keys file the user will get Permission denied (publickey).

If PasswordAuthentication is available the user will be asked few times for their password and in the end will get Permission denied (password). So if you want to further tease him (or her), change the above directives in this way:

Match User guest
    PasswordAuthentication yes
    PubkeyAuthentication no
    MaxAuthTries 20
    Banner /etc/ssh/banner_guest
    DenyUsers guest
Match all

For me the cleanest way is just show the message and kick them:

Match User guest
    PasswordAuthentication no
    PubkeyAuthentication no
    MaxAuthTries 1
    Banner /etc/ssh/banner_guest
    DenyUsers guest
Match all

The result of the above will be identical as the result of the first suggestion but the message Permission denied (publickey) (Server refused our key) will not appear.

pa4080
  • 30,621
1

I guess you are referring to /usr/sbin/nologin shell.

It is much simpler than the other answer implementing something like this more complex way. Just add:

Match User guest
  ForceCommand /usr/sbin/nologin

And the user will get the message:

This account is currently not available.

(or other configured in /etc/nologin.txt)

pa4080
  • 30,621
Jakuje
  • 6,793