Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteUse OpenSSH’s allow-list directives to decide who may connect, then add narrowly scoped deny rules for exceptions. For a changing set of administrators, create a dedicated group and set AllowGroups; for a small, fixed set, use AllowUsers. Password-locking an account alone does not block an existing SSH public key, so key access and SSH policy must be handled together.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What an Ubuntu SSH login policy controls
On a typical Ubuntu server, remote terminal access is handled by the OpenSSH daemon. Its server configuration determines which authenticated accounts are allowed to complete an SSH login. Authentication and authorization are separate decisions: a user may present a valid password or public key and still be rejected by an allow or deny rule.
As an Amazon Associate I earn from qualifying purchases.
The main directives are:
AllowGroupspermits login only when the user’s primary group or supplementary group list matches one of the listed patterns.AllowUserspermits only matching user-name patterns.DenyUsersblocks matching user names.DenyGroupsblocks users whose primary or supplementary group list matches a listed pattern.
Ubuntu’s OpenSSH manual documents deny rules as being processed before allow rules. That order matters when an account matches both a permit and a deny pattern: the explicit deny remains an exclusion.
Patterns can also include a source restriction in the form USER@HOST. The host portion can be a host name, address, or CIDR range, so a rule can limit a particular account to a management network rather than every source address.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the right restriction method
| Approach | Best for | How membership changes | Network specificity | Typical risk |
|---|---|---|---|---|
AllowGroups |
A team or administrator population that changes over time | Add or remove users from one group | All sources unless patterns include a host restriction | A mistaken group removal can lock out an administrator |
AllowUsers |
A small, fixed set of named accounts | Edit the user list in SSH configuration | Can use USER@HOST and CIDR |
Omitting a required account denies it immediately after reload |
DenyUsers |
One-off exclusions, such as a former administrator | Add or remove a name in the deny list | Can use USER@HOST |
A broad pattern can block more accounts than intended |
DenyGroups |
Excluding an entire class of accounts | Change group membership or the deny pattern | Applies to all matching users unless constrained by a host pattern | Primary and supplementary groups both count |
Do not combine several broad allow lists casually. Once an allow directive is present, users must satisfy an applicable allow condition. Design one clear baseline, then add only the exceptions you can explain and test.
Plan the change without locking yourself out
Make the change from a root-capable administrative account, but keep the current SSH session open until a second session proves the new policy works. A syntax error or an incomplete allow list can otherwise leave you without a remote path back into the server.
Checklist before editing
- Identify at least one non-root administrative account that must retain access.
- Confirm how that account authenticates (password, public key, or both).
- Record the server’s current SSH configuration and any included drop-in files.
- Decide whether the policy should cover every source address or only a management subnet.
- Keep an alternate console or out-of-band access method available if the server provides one.
- Leave the existing administrative session connected while validating the replacement session.
Ubuntu installations commonly use /etc/ssh/sshd_config, but that file may include additional configuration files. A rule in an included file or a later conditional Match block can change the effective result, so review the complete configuration rather than editing a line in isolation.
Recommended pattern: restrict SSH with a dedicated group
A dedicated group is easier to maintain than repeatedly editing a long list of account names. Ubuntu’s user-management guidance uses a group such as sshlogin: only members of that group are eligible for SSH access.
1. Create the group
Run this as root or with sudo:
sudo groupadd sshloginIf the group already exists, the command reports that fact; do not create a second group with a different spelling.
2. Add approved accounts
sudo usermod -aG sshlogin alice
sudo usermod -aG sshlogin bobThe -aG form appends the group while preserving each user’s existing supplementary groups. Omitting -a can replace the supplementary-group list, so do not use a plain usermod -G for this task unless you intentionally want to rewrite all supplementary memberships.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Verify membership
getent group sshlogin
id alice
id bobgetent group sshlogin shows the group’s members; id shows the groups associated with a particular account. A user who was already logged in may need to start a new session before client-side group information reflects a membership change.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
4. Add the allow rule
In /etc/ssh/sshd_config, add a global rule in the appropriate server configuration section:
AllowGroups sshloginThis means a user must belong to sshlogin through either the primary group or a supplementary group to be admitted by the SSH authorization policy. Existing local console access is not changed by this directive; it controls the SSH daemon.
5. Limit the group to a source network when necessary
If all members may connect only from a management network, use a host-qualified pattern instead of an unrestricted group pattern. For example, the documented USER@HOST syntax supports a CIDR source:
Recommended Free Tools
AllowUsers [email protected]/24Use this form when the restriction is account-specific. If the same network boundary should apply to every member of a group, express the policy with the available OpenSSH pattern syntax and test it carefully; a source restriction that is too broad or too narrow can produce surprising results.
Use AllowUsers for a small fixed set
For a server with only a few approved accounts, list them directly:
AllowUsers alice bobUbuntu defines this as allowing login only for user names that match one of the listed patterns. Every account that needs SSH access must appear in the effective allow policy; service accounts, deployment accounts, and emergency administrators are not implicitly preserved.
A host-qualified entry narrows one account without granting the same source restriction to another:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
AllowUsers [email protected]/24 bobHere, alice is limited to the specified CIDR range while bob remains matched by name. Treat CIDR ranges as authorization boundaries: include only the addresses from which that account should legitimately connect.
Add explicit exclusions with deny rules
Use a deny directive when the normal allow policy should remain broad but one account or group must be excluded. Examples:
DenyUsers formeradmin
DenyGroups contractorsDenyUsers matches account names; DenyGroups matches primary or supplementary groups. Because Ubuntu documents deny processing before allow processing, adding a user to an allow group does not create a reliable exception to a matching deny rule.
Keep deny patterns narrow. A group name that is reused for file permissions, application access, or temporary projects may unintentionally remove SSH access from unrelated accounts. If the exclusion is temporary, record why it exists and set a review date in your administrative records.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Block one account without deleting it
To stop a particular user from using SSH while retaining the account’s files and ownership, add the account to the SSH deny policy:
DenyUsers oldaccountThat blocks the account at the SSH authorization layer after the configuration is validated and reloaded. It does not delete the user, remove scheduled jobs, or change access through other services.
You may also need to remove or disable the account’s SSH public-key path, especially when the account should not authenticate remotely through any future SSH configuration. Review the user’s ~/.ssh/authorized_keys and any centrally managed key locations according to your account-management process.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Why locking the password does not solve this
Ubuntu explicitly warns that disabling or locking a user password does not prevent remote login when that user has already configured SSH public-key authentication. A password lock affects password authentication; it does not invalidate a key that the SSH daemon accepts. Therefore, a complete offboarding action combines the appropriate key removal or disablement with an SSH deny rule, or with removal from the allow group.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Do not assume that a visible account lock proves that remote access is gone. Test the account from a separate client after applying the policy.
Handle root access separately
Ubuntu says the administrative root account is disabled by default in all Ubuntu installations. That default does not remove the need to review SSH root-login settings, particularly on systems that were upgraded, customized, or provisioned from an image.
Inspect the effective PermitRootLogin setting and decide whether direct root SSH is required. In most operational designs, administrators connect with a named account and then use controlled privilege elevation, which gives the logs an individual identity. Whatever policy you choose, test it with a non-root administrative account before ending your current session.
A group allow list can also exclude root if root is not a member of the permitted group, but do not rely on an incidental group relationship as your only root-login control. Review the explicit root-login directive and any conditional Match rules.
Check conditional rules and included files
OpenSSH supports Match blocks that apply settings only to selected users, groups, addresses, or connection conditions. A later conditional section can make a policy appear inconsistent if you inspect only the global lines. Included files can have the same effect.
When troubleshooting, identify:
- Every
AllowUsers,AllowGroups,DenyUsers, andDenyGroupsline. - All
Includedirectives and the files they load. - Any
Match User,Match Group, or address-based conditional blocks. - The effective
PermitRootLoginvalue and authentication methods relevant to the account.
Keep related access rules together where practical and add a comment explaining the owner and purpose of a non-obvious exception. Comments do not change authorization, but they prevent a future administrator from deleting a rule whose reason has been forgotten.
Validate the daemon before reloading it
Never reload a configuration that has not passed OpenSSH’s built-in configuration test. A safe sequence is:
- Save the edited configuration and confirm that the intended account or group appears in the allow policy.
- Run the daemon’s syntax test as root:
sudo sshd -t -f /etc/ssh/sshd_config- If the test reports an error, correct the file and run the test again. Do not reload while an error remains.
- Inspect the effective configuration when you suspect an included file or a conditional block is changing the result. OpenSSH provides a test mode that prints effective settings:
sudo sshd -T -f /etc/ssh/sshd_config- Leave the current administrative connection open.
- From a second terminal, start a new SSH connection as an account that should be allowed.
- Start another test from an account that should be rejected, or ask an authorized operator to perform that test. Confirm that the rejection is caused by the intended policy rather than a syntax or network failure.
- Only after those checks succeed, reload the SSH service:
sudo systemctl reload sshA reload applies the new daemon configuration without deliberately terminating existing sessions. It does not make an incorrect policy safe, so retain the original session until the new session has authenticated and reached a shell.
Test the policy as a matrix, not a single login
One successful login proves only that one account and one source satisfy the policy. Test the combinations that matter to your design:
| Test | Expected result | What a failure indicates |
|---|---|---|
| Approved account from an approved source | Authentication succeeds | The account may be missing from the allow list or group, or the source pattern may not match |
| Unapproved account from the same source | SSH authorization is rejected | The allow list is broader than intended or the account matches an unexpected pattern |
| Approved account from a disallowed source | Connection is rejected by policy | The USER@HOST or CIDR condition is absent or too broad |
| Password-locked account with an old public key | SSH access is rejected after key access is disabled or denied | The key path is still active, demonstrating why password locking alone is insufficient |
| Named administrative account after root policy review | Administrative access remains available | You may have created a root-only recovery dependency |
Record the date, the rule changed, the group membership change, and the person who approved it. Access-control changes are easier to audit when the configuration and membership history explain each other.
Troubleshoot common failures
The allowed user is rejected
- Check that the user is actually in the permitted group with
id username. - Check for a spelling or case mismatch in
AllowUsersor the group name. - Inspect all included files for another allow or deny directive.
- Check whether a
Matchblock applies different rules to that user or source address. - Verify that the client’s source address is inside the CIDR range used in a host-qualified rule.
A disallowed user can still log in
- Confirm that the new configuration was validated and reloaded on the server you are actually connecting to.
- Look for a spelling variation, alternate account name, or a second SSH service listening on another address or port.
- Review supplementary groups: a user can match
AllowGroupsthrough a supplementary group, not only the primary group. - Check for a conditional rule that changes the effective policy.
The password-locked account still connects
Inspect and disable the account’s accepted public keys, then apply a DenyUsers rule or remove the account from the permitted group. A password lock does not revoke an already configured SSH key.
The daemon refuses to reload
Run sudo sshd -t -f /etc/ssh/sshd_config again and correct the reported line. Common causes include a misspelled directive, an invalid pattern, or a malformed included file. Keep the established session open while fixing the file.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Maintain the policy over time
A login allow list is only as accurate as its membership data. When someone joins or leaves the administrative team, update the dedicated group promptly and review any account-specific deny or source rules. Remove stale exceptions rather than accumulating contradictory directives.
- Use one documented group for the normal SSH population.
- Reserve
AllowUsersfor genuinely fixed, exceptional accounts or clearly defined host-qualified access. - Use deny directives for explicit exclusions and document their reason.
- Review public keys during offboarding; do not treat password status as proof that SSH access is disabled.
- Re-test an allowed account and a denied account after significant membership or configuration changes.
- Keep a second administrative path available before tightening the policy.
This approach gives you a clear authorization boundary, predictable exception handling, and a recovery plan when a configuration change does not produce the result you expected.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
