We are writing an application (perl, mysql) that will run headless on a *nix (likely CENTOS).

How can I setup/secure the local user/password for the account 'app' (where the app will be running) so that,

  • a remote ssh-login is not possible
    ssh is working, so are logins for all accounts, but I need to secure this single account
  • a 'su app' works for users with existing accounts

What is such a setup called? I'm certainly not the first one to try this, it must be documented many times, but I fail to find the relevant search terms for Google.

EDIT: Solution

I added the lines:

# prevent certain users from using ssh for login
# while retaining the option to 'su username'
DenyUsers app

to /etc/ssh/sshd_config

then restartet sshd using

service sshd restart

I can now login as 'user' over ssh and 'su app' to work as app.

2 Answers 2


put all users into a group 'remote_users' and specify in your sshd.conf, that only users from that groups are allowed to login via ssh:


         This keyword can be followed by a list of group name patterns,
         separated by spaces.  If specified, login is allowed only for
         users whose primary group or supplementary group list matches one
         of the patterns.  Only group names are valid; a numerical group
         ID is not recognized.  By default, login is allowed for all
         groups.  The allow/deny directives are processed in the following
         order: DenyUsers, AllowUsers, DenyGroups, and finally
  • setting the login shell to /bin/false prevents a local user from bein able to 'su app' or 'su - app'
    – lexu
    Oct 27, 2009 at 9:51
  • 1
    just as a side question: why should users be do this 'su app' anyway?
    – akira
    Oct 27, 2009 at 9:53
  • Why cannot one simply forbid the "app" group/user forbid to login in via sshd.conf?
    – foraidt
    Oct 27, 2009 at 9:57
  • @akira: not all users, just some. They need to edit crontable, change config files, run jobs etc that depend on the 'app' user's credentials. We don't want them to login as 'app', so they feel the system can identidy them => keep the guilty out of trouble.
    – lexu
    Oct 27, 2009 at 10:48
  • @mxp and @akira: I'll look into the possibilities of sshd.cond, thx
    – lexu
    Oct 27, 2009 at 10:49

If you are using openssh keys to login via ssh, you could simply disallow password logins for all accounts. suing would still be possible.

  • This was considered, but denied, since the users might not always have the ssh keys with them (my arguing that a login to home-server, then ssh-ing to the app-target, didn't penetrate/was deemed to complex)
    – lexu
    Oct 27, 2009 at 11:17
  • OK. Technically still a possibility though.
    – innaM
    Oct 27, 2009 at 11:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .