26

How can I get the list of all the users who can ssh to a server via ssh [email protected] ?

Please note that I'm aware of this question and that is not doing what I want!

If it helps the server has so many users in so many different groups and under the home directory there are some group directories and many user directories in those group directories.

Edited:

Please note that the result I get from /etc/passwd is not what I want and is as follows:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
Debian-exim:x:101:103::/var/spool/exim4:/bin/false
statd:x:102:65534::/var/lib/nfs:/bin/false
sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin
shelladmin:x:1000:1000:shelladmin,,,:/home/shelladmin:/bin/bash
messagebus:x:104:106::/var/run/dbus:/bin/false
festival:x:105:29::/home/festival:/bin/false
ntp:x:106:108::/home/ntp:/bin/false

This list doesn't even include my own username! let alone the other 1000 users.

Edited 2:

So I chatted with Yaron a little and Here are some more info about the system:

-bash-4.2$ ls -lsa /etc/init.d/nis
ls: cannot access /etc/init.d/nis: No such file or directory
-bash-4.2$ ls -lsa /var/yp
ls: cannot access /var/yp: No such file or directory
if it helps, this is the putput of ls -lsa /var
-bash-4.2$ ls -lsa /var
total 48
4 drwxr-xr-x 12 root root 4096 Oct 25 2016 .
4 drwxr-xr-x 22 root root 4096 Oct 25 2016 ..
4 drwxr-xr-x 2 root root 4096 Oct 26 2016 backups
4 drwxr-xr-x 10 root root 4096 Oct 25 2016 cache
4 drwxr-xr-x 34 root root 4096 Oct 25 2016 lib
4 drwxrwsr-x 2 root staff 4096 May 7 2012 local
0 lrwxrwxrwx 1 root root 9 Oct 25 2016 lock -> /run/lock
4 drwxr-xr-x 9 root root 4096 Dec 10 06:25 log
4 drwxrwsr-x 2 root mail 4096 Jul 30 00:51 mail
4 drwxr-xr-x 2 root root 4096 Nov 21 2012 opt
0 lrwxrwxrwx 1 root root 4 Oct 25 2016 run -> /run
4 drwxr-xr-x 5 root root 4096 Oct 25 2016 spool
4 drwxrwxrwt 12 root root 4096 Dec 10 08:18 tmp
4 drwxr-xr-x 2 root root 4096 Feb 16 2013 www
-bash-4.2$ getent passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
Debian-exim:x:101:103::/var/spool/exim4:/bin/false
statd:x:102:65534::/var/lib/nfs:/bin/false
sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin
shelladmin:x:1000:1000:shelladmin,,,:/home/shelladmin:/bin/bash
messagebus:x:104:106::/var/run/dbus:/bin/false
festival:x:105:29::/home/festival:/bin/false
ntp:x:106:108::/home/ntp:/bin/false
-bash-4.2$ cat /etc/nsswitch.conf
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd: files ldap
group: files ldap
shadow: files ldap

hosts: files dns
networks: files

protocols: db files
services: db files
ethers: db files
rpc: db files

netgroup: nis
-bash-4.2$ cd /etc/sssd/
-bash: cd: /etc/sssd/: No such file or directory
4
  • "let alone the other 1000 users." what other 1000 users? who made these users? if this is on an Active Domain you wont be able to get a list.
    – Rinzwind
    Dec 10, 2017 at 16:27
  • it's for my university. every student has an account. Of course the users are not created manually.@Rinzwind Dec 10, 2017 at 18:35
  • like I said: active directory. you will not get a list of users from Ubuntu's system.
    – Rinzwind
    Dec 10, 2017 at 18:40
  • I don't know about active directory. Can you provide me a link to read about it? @Rinzwind Dec 10, 2017 at 18:41

2 Answers 2

23

My answer draws from answers to this stackoverflow question.

Listing all "users"

I was expecting there would be a way I could just say, show me all the users that can ssh onto my server.
What I didn't realise is that there isn't a distinction between people-users and system-"users", so while you can list all users with this command, it's probably a lot longer than you were expecting/hoping-for:

cat /etc/passwd

Showing all users with a valid shell

If the users shell is set to /etc/false then they cannot log on, so this trims down the list of possible ssh users :

cat /etc/passwd | grep -v /bin/false

But that is still a pretty big list.


Users who have actually have access

If a user doesn't have a valid password that could be an indication that they can't log on.
The /etc/shadow file holds the encrypted passwords, a "!" or a "*" in the 2nd column of this file means no password is set. We can filter those out for a new (probably shorter) list of users that have a valid password :

cat /etc/shadow | grep '^[^:]*:[^\*!]'

Details about the regex:

  1. ^ - The pattern have to be at the start of the line
  2. [^:]* - Match any character that is not : between 0 and unlimited time
  3. : - Match the character : literally
  4. [^\*!] - Match any character that is not *,! once.

Note that the regex is wrap with single quotes, this is important because many character special to regex are special to bash as well (See part 2 of this answer)

The only other accounts that are not covered by that would be where they have an ssh key on their user account, so you need to also look at the users that have a home folder :

ls -l /home

Restricting access

OK - so now I have a somewhat limited list - and I want to remove access for a couple of accounts.
@Yaron's answer describes this in more detail (as does this), but briefly; the /etc/ssh/sshd_config file says which accounts can ssh, and if you set AllowUsers in there then the other users will be restricted - so you can edit that file to be explicit about who you want to allow to log on:

vi /etc/ssh/sshd_config

And add a line saying

AllowUsers user1 user2

Finally restart the ssh service

service ssh restart

(depending on your system - see this for service restart on other systems)

8

By default all users of a specific machine can login into this machine using ssh.

You can configure sshd to allow access to only part of the machine users.

Ubuntu ssh man page Specify that you can allow/deny specific users/groups in sshd_config — OpenSSH SSH daemon configuration file - /etc/ssh/sshd_config

  • AllowUsers This keyword can be followed by a list of user name patterns, separated by spaces.
  • If specified, login is allowed only for user names that match one of the patterns.
  • Only user names are valid; a numerical user ID is not recognized.
  • By default, login is allowed for all users.
  • If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts.
  • The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups

The list of all users in the server machine can be found by running the below command on the server machine:

cat /etc/passwd

According to the updated question, the /etc/passwd doesn't hold several usernames. This might be the result of the server being part of Network Information Service, LDAP or SAMBA.

To review all users & groups known by your server, from whatever sources they come, you would preferably use the getent command :

getent passwd

Discussion summary:

It seems that you have LDAP on the server, and it was defined to disable access the listing of LDAP users.
Otherwise getent passwd would show you the passwd file

10
  • I want to get the list of all the users who can ssh to the server! I can't find a way to do this in your answer! Dec 10, 2017 at 10:47
  • @aran - as I wrote in my answer By default, login is allowed for all users., i.e. every user which have account on the server can login using ssh to the server.
    – Yaron
    Dec 10, 2017 at 11:49
  • @aran - you can limit the amount of users, using the sshd_config configuration params: DenyUsers, AllowUsers, DenyGroups, and AllowGroups - to deny access for specific users, and/or allow access only to specific users
    – Yaron
    Dec 10, 2017 at 11:50
  • @aran - the full list of users which can login into the server (not limited to ssh-login) can be found in /etc/passwd
    – Yaron
    Dec 10, 2017 at 11:52
  • @Aran - see my updated answer, regarding ypcat passwd
    – Yaron
    Dec 10, 2017 at 14:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .