iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The safest way to control SSH access on Ubuntu is to create an allow-list in OpenSSH, preferably with a dedicated group, then add narrow deny rules only for exceptions. Password locking alone is not sufficient: an account with an authorized SSH key can still authenticate unless you also remove or disable that key path or block the account in SSH policy.
This guide shows how to restrict access by user, group, source network, and root policy; how to account for conditional Match blocks; and how to validate the configuration without locking yourself out.
How OpenSSH decides who may log in
Ubuntu’s OpenSSH server evaluates several independent controls. Authentication must succeed first, but a successful password or key does not automatically grant a session: user and group restrictions can reject the connection afterward.
| Directive | What it allows or blocks | Best fit |
|---|---|---|
AllowUsers |
Only listed user-name patterns may log in. | A small, fixed set of accounts. |
AllowGroups |
Only users whose primary or supplementary group matches a listed pattern may log in. | A team or changing population managed through group membership. |
DenyUsers |
Blocks matching user-name patterns. | A specific exclusion from an otherwise broad policy. |
DenyGroups |
Blocks users whose primary or supplementary group matches a listed pattern. | Excluding a class of accounts. |
PermitRootLogin |
Controls whether and how the root account may use SSH. | Separating direct root access from normal administration. |
Ubuntu’s current OpenSSH manual documents deny directives as being processed before allow directives. In practical terms, do not assume that adding a user to an allowed group will override a matching DenyUsers or DenyGroups rule.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
An allow directive applies globally unless it is inside a conditional Match block. A later conditional section can change the effective settings for a particular user, address, or connection pattern, so inspect the whole configuration rather than editing only the first lines you find.
Before changing SSH access
- Keep your current administrative SSH session open until a second session has successfully logged in with the intended policy.
- Have a separate console, out-of-band management path, or cloud serial console available in case SSH becomes inaccessible.
- Identify at least one non-root administrative account and confirm that its public key or password works before restricting other users.
- Record the current file and any included drop-ins. Ubuntu installations may load additional files from an include directory configured by
sshd_config.
Back up the configuration with a root-capable account:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.backup-$(date +%Y%m%d-%H%M%S)Do not close the session that created the backup. You may need it to undo a policy that was applied incorrectly.
Recommended pattern: restrict SSH with a dedicated group
A dedicated group is easier to maintain than repeatedly editing a list of names. Ubuntu’s user-management guidance uses this pattern: create a group such as sshlogin, add only approved accounts, and allow that group in OpenSSH.
1. Create the group
sudo groupadd --system sshloginIf the group already exists, the command reports that fact; do not create a second group with a different spelling.
2. Add approved accounts
sudo usermod -aG sshlogin alice
sudo usermod -aG sshlogin bobThe -aG options append the group without removing the user’s existing supplementary groups. A user must start a new login session before the changed supplementary-group list is reflected in that session. Verify membership from an administrative shell:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsgetent group sshlogin
id alice3. Add the allow-list
Edit the global portion of /etc/ssh/sshd_config, or the distribution’s SSH configuration drop-in used for local policy:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
AllowGroups sshloginPlace this directive outside any Match block unless you intentionally want the restriction to apply only to a condition. The rule permits a user when either the primary group or a supplementary group matches sshlogin.
4. Keep membership changes as the access-control operation
After this policy is active, onboarding means adding an account to sshlogin; offboarding means removing it:
sudo gpasswd --add carol sshlogin
sudo gpasswd --delete carol sshloginRemoving a user from the group affects new SSH sessions. It does not terminate a session that is already open, so separately revoke active sessions when your incident or offboarding procedure requires it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Allow only a small, fixed set of users
For a server with a short, stable list, use AllowUsers:
AllowUsers alice bobOpenSSH then permits login only for user names matching the listed patterns. This is direct and easy to audit for two or three accounts, but it becomes error-prone as people join, leave, or change roles.
Do not combine a broad group allow-list and a separate user allow-list without testing the resulting intersection. When several allow controls are present, a user generally needs to satisfy the applicable allow conditions; an account present in one list can still be rejected by another. Use one primary model unless a deliberate, documented intersection is required.
Restrict a user by source address
AllowUsers supports the documented USER@HOST form. The host part can be a hostname, address, wildcard pattern, or CIDR range. For example:
Recommended Free Tools
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
AllowUsers alice@192.0.2.0/24This permits alice only when the connection source matches the specified range. It does not grant that network access to other users. If the account must connect from more than one network, add an additional matching pattern or use a separate policy design that clearly lists every approved source.
Source restrictions are only as reliable as the address OpenSSH sees. NAT, bastion hosts, VPN gateways, and proxying can make the server observe an intermediate address instead of a person’s workstation. Confirm the real source address in your connection logs before deploying a CIDR restriction.
Add explicit exclusions with deny rules
Use deny directives when a small number of exceptions must be blocked while the rest of an allow policy remains unchanged:
DenyUsers contractor-temp
DenyGroups suspendedDenyUsers matches names; DenyGroups matches a user’s primary or supplementary groups. Ubuntu’s manual states that deny processing occurs before allow processing, so a matching deny rule wins even if the account also appears in an allowed list. Keep exception rules narrow and document why each exists.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAvoid using a deny rule as a substitute for removing an account from the dedicated access group. Group membership expresses the intended steady state; a deny rule is most useful for a temporary or exceptional block that should remain visible in the configuration.
Handle root separately
Ubuntu says the administrative root account is disabled by default in all Ubuntu installations, but you should still inspect the SSH root-login setting on the specific server. Review any existing PermitRootLogin directive and decide whether direct root SSH is needed at all.
A common administrative design is to log in with a named account that is allowed by AllowGroups or AllowUsers, then use sudo for privileged commands. Test that non-root path before changing root policy. If you disable the only working administrative route, an otherwise correct allow-list can still lock you out.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Password locking does not revoke SSH keys
Ubuntu explicitly warns that disabling or locking a user password does not prevent remote login when the account already has an SSH public key. Public-key authentication can succeed without using the password database entry.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When an account must no longer connect, apply the SSH policy and address the key path:
- Remove the account from the allowed group or user list.
- Add a narrowly scoped
DenyUsersorDenyGroupsexception if immediate blocking is required. - Inspect and remove or disable the account’s authorized keys, commonly in
~/.ssh/authorized_keys, according to your key-management process. - Revoke keys centrally if your organization uses a certificate authority or managed SSH access system.
- Terminate existing sessions separately; access-control changes affect new authentication attempts.
Locking the password can still be appropriate as one part of account deactivation, but it is not an SSH access-control mechanism by itself.
Account for configuration drop-ins and Match blocks
Ubuntu’s SSH configuration may include additional files. Look for Include directives in the main file and inspect the referenced directory for another AllowUsers, AllowGroups, deny directive, or Match block.
A Match User, Match Group, Match Address, or combined condition can apply different settings to a subset of connections. A policy that looks correct in the global section may therefore behave differently for one user or network. Keep global allow/deny rules in the global section unless conditional behavior is intentional, and test each condition that matters.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Validate before reloading SSH
OpenSSH provides a test mode that parses the daemon configuration without starting a new listener. Run it before applying a change:
sudo sshd -t -f /etc/ssh/sshd_configNo output normally indicates that the file parsed successfully. A syntax error prints a line number and must be corrected before reloading. If your installation uses a different main file or an included configuration path, pass the actual file used by the service.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
To inspect the daemon’s effective global settings, use:
sudo sshd -T -f /etc/ssh/sshd_configFor conditional rules, OpenSSH can evaluate the configuration for a particular connection context. Supply the user, host, and source address that represent the test:
sudo sshd -T -C user=alice,host=server.example,addr=192.0.2.25 -f /etc/ssh/sshd_configCheck the resulting output for the applicable allow, deny, root-login, and authentication settings. The exact output depends on the OpenSSH version and the configuration present on the server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test access without locking yourself out
- Leave the original administrative session connected.
- Open a second terminal and connect as an account that should be allowed.
- Confirm that the session reaches a shell and that required
sudoprivileges still work. - Open a third test using an account that should be denied. Verify that authentication is refused by the server’s access policy.
- If source restrictions are present, repeat the test from each approved network or through the same bastion path real users will use.
- Only after the tests pass, reload the service.
sudo systemctl reload sshReloading asks the running daemon to reread its configuration while existing sessions generally remain connected. It does not replace the need for a second-session test: a syntactically valid policy can still deny every administrator.
After the reload, repeat the allowed and denied tests. Record the final policy, group membership, test accounts, source networks, and change time so another administrator can reconstruct the access decision.
Troubleshoot common outcomes
An intended user is rejected
- Check that the user is in the exact group named by
AllowGroups:id username. - Ensure the user started a new session after group membership changed.
- Search all included files for another allow or deny directive.
- Inspect
Matchblocks and evaluate the effective configuration withsshd -T -C. - Check whether a
DenyUsersorDenyGroupspattern matches first.
A blocked user can still connect
- Confirm that the attempted account name is the one being denied; aliases or a different account may be used.
- Check for an allowed supplementary group that bypasses an assumed group-based restriction.
- Inspect authorized keys and any certificate-based access path.
- Review logs for the actual source address and authentication method.
- Verify that the edited file is the one loaded by the running service, then reload after validation.
The daemon will not reload
Run sudo sshd -t -f /etc/ssh/sshd_config and correct the reported line. Common causes include a misspelled directive, an unmatched Match context, or editing a file that is not valid for the installed OpenSSH version. Keep the original session open while recovering.
Choosing the right restriction model
| Situation | Preferred control | Reason | Main risk |
|---|---|---|---|
| One to three permanent administrators | AllowUsers |
Names are immediately visible and simple to audit. | Every personnel change requires editing configuration. |
| A team whose membership changes | AllowGroups with a dedicated group |
Access changes occur through group administration, not repeated file edits. | Accidentally adding an account to the group grants SSH access. |
| Access only from a management network | USER@HOST patterns, often combined with group control |
Limits both identity and source network. | NAT, VPN, or bastion routing can change the observed address. |
| A temporary suspension | DenyUsers or DenyGroups |
Creates an explicit, auditable exception. | The deny rule still applies until it is removed. |
| Direct root access | Review PermitRootLogin and use a named administrative account where possible |
Separates accountability from the shared root identity. | Changing root policy without testing another administrator can cause lockout. |
Operational checklist
- Use a dedicated allow group when the user population is not fixed.
- Keep the global policy separate from intentional
Matchrules. - Use deny directives for documented exceptions, not as an untracked replacement for membership management.
- Never treat password locking as proof that SSH access is revoked.
- Review authorized keys and certificate access during deprovisioning.
- Validate with
sshd -t, inspect effective settings, and test both an allowed and a denied account. - Maintain a second administrative path and an open recovery session while applying changes.
- Document who is in the access group, which source networks are approved, and when the policy was last tested.
Frequently Asked Questions
Can I restrict SSH access without deleting a user account?
Yes. Remove the account from the SSH allow group or user list, or add a matching deny rule. Also review and revoke authorized keys, because locking the password alone does not block key-based login.
Does AllowGroups check only a user’s primary group?
No. Ubuntu’s OpenSSH manual states that a match in either the primary group or the supplementary group list permits the user when the group is listed.
What should I do if an SSH change locks out every administrator?
Use the still-open session or an out-of-band console to restore the backup, remove the restrictive directive, validate with sshd’s test mode, and reload only after an allowed second session succeeds.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
