Mastering Linux Security and Hardening - Second Edition

Configuring whitelists within sshd_config

The four access control directives that you can set within sshd_config are as follows:

• DenyUsers
• AllowUsers
• DenyGroups
• AllowGroups

For each directive, you can specify more than one username or group name, separating them with a blank space. Also, these four directives are processed in the order that I've listed them here. In other words, if a user is listed with both the DenyUsers and the AllowUsers directives, DenyUsers takes precedence. If a user is listed with DenyUsers and is a member of a group that's listed with AllowGroups, DenyUsers again takes precedence. To demonstrate this, let's complete a lab.