Mailing List Archive

[Bug 3193] New: Add separate section in sshd_config man page on Access Control

Bug ID: 3193
Summary: Add separate section in sshd_config man page on Access
Product: Portable OpenSSH
Version: 8.3p1
Hardware: Other
OS: Linux
Status: NEW
Severity: enhancement
Priority: P5
Component: Documentation

In the sshd_config man page, I suggest you add a separate section to
provide a summary of common access control methods.


In sshd, the access controls are placed in the configuration file. The
following example is a starting point for a simple access policy:

PermitRootLogin no
DenyUsers @*
DenyGroups root
AllowUsers user@10.1.1.* # Local network
AllowUsers user@ # External site 1
AllowUsers user@ # External site 2
Match group ssh-users
AllowUsers *

The PermitRootLogin directive prevents ne'er-do-wells from brute-force
attacking your root password. The DenyGroups directive backs up the
no-root-login policy

The DenyUsers wild card establishes a mostly-closed security policy.

Each AllowUsers directive permits unrestricted access for "user"
sourced from the specified IPv4 address. (*** IPv6 example?)

The Match directive and the accompanying AllowUsers predicate permits
any user, belonging to group "ssh-users", to log in from anywhere.
(Remember not to specify "ssh-users" as a group for root.) A safer
predicate would be "AllowUsers *@10.1.1.*" to limit access on the local

Permission to use the above granted.

If y'all think it appropriate, you can include verbage describing how
AllowUsers, DenyUsers, AllowGroups, and DenyGroups interact. Also,
what directives can trump other directives. In particular, how sshd
handles overlapping AllowUsers and DenyUsers directives -- which wins?

You are receiving this mail because:
You are watching the assignee of the bug.
openssh-bugs mailing list