I have a setup of systems, where each system has multiple users but only one user is allowed to login to a system at a time through SSH.

I am using "passwd -l/-u" command to lock and unlock users, and allow only one user at a time.

What I need is to tell the other users trying to SSH to a system why they cannot SSH. Currently when the user account is locked and they cannot SSH they only get "Connection Refused" message. I want to be able to edit this message to tell them "Your account is locked and you cannot login before xxxxxxx time"

What are the possible ways I can achieve this. I have tried googling for this but without any luck.


  • You can't do this inside SSH, and in order to display such a message, you would have to let them log in first, then have bash tell them why they 'cant' log in and then log them out. – Daniel Jul 27 '15 at 22:33
  • @Daniel : ok, I will try the approach you suggested. BTW do you mean we cannot change the "Connection Refused" message at all , to any custom message in any scenario ? – CodeWithPride Jul 27 '15 at 22:37
  • You could download the ssh and sshd sources, make any changes you like, and use the modified versions. When a newer version of ssh or sshd is released, you would have to reapply your changes, or stay with your old, customized version. A Bad Idea. – waltinator Jul 28 '15 at 0:55
  • I found a better solution to my needs. To re-enable the user to /usr/bin/nologin where I can display them a message from /etc/nologin.txt. And when I want to activate then I can change their shell back to /bin/bash. I could use usermod command to do this from a script. – CodeWithPride Jul 28 '15 at 0:59
  • ^ That works! super! – Daniel Jul 28 '15 at 14:36

If you want to customize the message but not per-user you can use nologin, meaning re-enabling users account but assigning them /usr/bin/nologin as their login shell. They will not be able to connect and receive a default message saying the account is disabled or the message written in /etc/nologin.txt.

If you want a per-user message you can replace nologin with a hand-made script which always returns 1.

From https://serverfault.com/a/708923/186199 where is dupplicate marked as solved. Please mark it so here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.