PAM pam_access.so Rules Not Denying SSH Access for Users in wheel Group

[Maximus_el]

I am trying to restrict SSH access for users in the wheel group using PAM and pam_access.so on Red Hat9. Despite following all necessary steps, users in the wheel group are still able to log in via SSH from remote hosts, which should be denied according to my configuration.

Here’s what I have done so far:

1. Added the following line to /etc/pam.d/sshd, /etc/pam.d/password-auth, and /etc/pam.d/system-auth:

   account required pam_access.so

2. Configured PAM for SSH in /etc/ssh/sshd_config:

   UsePAM yes

3. Configured the rule in /etc/security/access.conf:

   -:wheel:ALL EXCEPT LOCAL

4. Notes:

   • I tried setting SELinux in permissive mode.
   • SSH service was restarted after each configuration change.

Despite all these configurations, users in the wheel group can still log in via SSH from any remote host, which contradicts the intended restriction.

Any insights or guidance would be greatly appreciated.

[TM · Accepted solution]

Hello @Maximus_el ,

The following 2 commands should do the job.

echo 'DenyGroups wheel' > /etc/ssh/sshd_config.d/73-deny_wheel_group.conf
systemctl reload sshd

Regards,

Tshimanga

[Maximus_el]

Beautiful! since the directive 'Include /etc/ssh/ssh_config.d/*.conf' is there

thank you for your help!

[Trevor · Accepted solution]

Hello Maximus,

I don't see that you included a very essential piece
in your /etc/ssh/sshd_config file.  Add the following
line to that file:

                DenyGroups  wheel

After adding that line, restart your ssh daemon.

Standing by for your report.

[Maximus_el]

Thank you for your help, it worked, oh and yes i really forgot about sshd_config.

Thank you again !

[Trevor]

Hello Maximus,

Would you be okay with providing the complete content
of your /etc/ssh/sshd_config file?

[Maximus_el]

it worked and i have no ide how i typed || who wrote "didnt"

thank you for your help

[Trevor]

Alrighty then!!!  That's a big relief for both of us!  
I thought I might have to spend an all-nighter
trying to uncover the issue

Please disregard that last request for the complete
/etc/ssh/sshd_config file!!!!

I'm celebrating with you that you've gotten what you
needed!!!  Thanks for reaching out to the community!!!

[TM]

Hi @Maximus_el,

As you might have realize @Trevor and I used the simple sshd config of DenyGroups, even if we did it in two different locations, and it works.

I just hope that the requirement of the question is not to explicitly use PAM.
If it is the case, let us know. Because you might fail to that question if you do it our ways.

Regards,

Tshimanga

[Maximus_el]

"First off, I’d like to extend my gratitude to you, @TM , and @Trevor  for your invaluable insights and support. It’s incredible how much your assistance motivates and propels everyone forward.

Secondly, I fully grasp your point. Although I’m nearing the end of my RHCSA studies, I’m not rushing into the exam just yet. My current focus is to deepen my understanding and gain practical experience with RHEL beside technologies like Nginx, DevOps tools including Ansible and Docker, and AWS. I’m working on setting up a server for a family project before I schedule any exams. For now, my journey is all about learning and practicing.

Thank you again for being such a pillar of support in this community.

Regards,