Mastering Linux Security and Hardening - Second Edition

Setting different configurations for different users and groups

On the server side, you can use the Match User or Match Group directive to set up custom configurations for certain users or groups. To see how it's done, look at the example at the very bottom of the /etc/ssh/sshd_config file. There, you'll see the following:

# Match User anoncvs# X11Forwarding no# AllowTcpForwarding no# PermitTTY no# ForceCommand cvs server

Of course, this has no effect since it's commented out, but that's okay. Here's what we see for user anoncvs:

• He can't do X11 forwarding.
• He can't do TCP forwarding.
• He won't have the use of a command Terminal.
• As soon as he logs in, he'll be starting the Concurrent Versioning Service (CVS) server. By not having use of ...