PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe safest way to limit SSH logins on Ubuntu is to create an explicit allow-list in OpenSSH: use AllowGroups for a changing team, or AllowUsers for a small fixed list. Add DenyUsers or DenyGroups only for specific exclusions, and use the USER@HOST form when access must come from a particular network. Validate the effective configuration and test a second administrative connection before reloading SSH. Locking a Unix password alone is not sufficient when the account still has an authorized SSH key.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Which SSH control should you use?
Ubuntu’s OpenSSH server evaluates user and group restrictions during authentication. An allow rule changes the default from “any otherwise-authenticated account” to an explicit list. Choose the narrowest control that matches how you administer the machine.
As an Amazon Associate I earn from qualifying purchases.
| Directive | Best use | What it matches | Maintenance impact |
|---|---|---|---|
AllowGroups |
A team or role whose membership changes | A user’s primary or supplementary group | Add or remove group membership without editing the SSH configuration |
AllowUsers |
A small, stable set of named accounts | User-name patterns | Every personnel change requires a configuration edit |
AllowUsers USER@HOST |
A named account that must originate from a known network | User name plus source host, address, or CIDR pattern | Precise, but every approved network must be maintained |
DenyUsers |
An explicit account exclusion | User-name patterns | Useful for exceptions, but easy to overlook during reviews |
DenyGroups |
An explicit role or group exclusion | Primary or supplementary group | Centralized exclusion for a whole class of accounts |
AllowGroups permits login only when the user’s primary or supplementary group list matches one of the listed patterns. AllowUsers permits only matching user-name patterns. If any deny directive matches, it blocks the account; Ubuntu’s current OpenSSH documentation describes deny processing before allow processing. A user therefore has to survive the deny checks and satisfy every applicable allow-list requirement.
Prepare a safe change
- Sign in through a root-capable administrative account. Do not make the change from the only SSH session you have.
- Identify the active configuration file. The usual file is
/etc/ssh/sshd_config; Ubuntu installations can also load snippets from an included/etc/ssh/sshd_config.d/directory. - Record the accounts that must retain access, their group memberships, and the network addresses from which they connect.
- Keep the current administrative session open until a separate test connection has authenticated successfully with the intended policy.
- Have a console, hypervisor, or other out-of-band recovery path available before changing an allow-list.
Back up the file or create a clearly named drop-in before editing. A drop-in makes ownership of the policy easier to audit, but inspect the complete effective configuration because an existing file may already define related directives.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Recommended pattern: restrict SSH with a dedicated group
A dedicated group is usually the most maintainable choice for a server with more than one administrator or with staff changes. Ubuntu’s user-management guidance uses a group such as sshlogin and then points AllowGroups at it.
1. Create the group
sudo groupadd sshloginIf the group already exists, keep it and proceed. Confirm its identity before adding users:
getent group sshlogin2. Add approved accounts
sudo usermod -aG sshlogin alice
sudo usermod -aG sshlogin bobThe -aG form appends the group; omitting -a can replace an account’s supplementary-group list, so do not use a bare usermod -G for this task. Verify membership with:
id alice
id bobOnly add accounts that are meant to establish SSH sessions. A service account that never needs remote administration should not be placed in the group merely because it has an account on the host.
3. Add the allow rule
Place the following in the active SSH configuration, either in /etc/ssh/sshd_config or in an included drop-in:
AllowGroups sshloginEvery account that is not in the listed group will fail the SSH user-authorization check, even if its password is correct or it has a valid public key. Because group membership is the control point, onboarding and offboarding become an identity-management operation rather than repeated edits to a long username list.
Recommended Free Tools
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
4. Remove access by changing membership
sudo gpasswd --delete alice sshlogin
getent group sshloginRemoving a member prevents a new SSH authentication after the server sees the updated group membership. It does not terminate a session that is already open; close or separately revoke an existing session when immediate removal is required.
Use AllowUsers for a small fixed list
For a machine with only two or three named administrators, an explicit list is easy to read:
AllowUsers alice bobOpenSSH’s definition is literal: when this directive is specified, login is allowed only for user names that match one of the patterns. A new administrator will be rejected until the name is added and the configuration is reloaded. Conversely, deleting a name from the line removes it from the allow-list without changing the Unix account itself.
Do not combine a broad AllowUsers list with an incomplete AllowGroups list unless you intentionally want both conditions to apply. Before saving, write down the expected result for each administrative account and check that every account satisfies all active restrictions.
Restrict an account by source network
OpenSSH supports a USER@HOST pattern for user-specific source restrictions. For example:
AllowUsers [email protected]/24This permits alice only when the connection source matches the documented network pattern. A connection from another address can still fail even when the username and credentials are valid. Use the actual address range assigned to your administration network, and remember that a changing residential or mobile address makes this approach operationally fragile.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Source restrictions are most useful when paired with an identity allow-list. A group rule expresses who may log in; a USER@HOST rule additionally expresses where that person may log in from. Keep the CIDR range as narrow as practical, and account for bastion hosts, VPN address pools, and IPv6 separately if they are part of your access path.
Add deny rules for explicit exceptions
Use DenyUsers and DenyGroups when a specific account or role must be excluded from an otherwise permitted population:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDenyUsers contractor-temp
DenyGroups suspendedDenyUsers matches user-name patterns. DenyGroups matches a user’s primary or supplementary groups. Ubuntu documents deny directives as being processed before allow directives, so an account that matches a deny rule is refused even if it also appears in an allow-list.
Keep exceptions narrow and document why they exist. A deny rule is not a substitute for removing a person from the normal access group: it can hide a stale membership and make future reviews harder. When an account is permanently offboarded, remove its group membership and disable its credentials; reserve deny rules for temporary blocks or policy exceptions that need to be visible in SSH configuration.
Review root access separately
Ubuntu installs the administrative root account disabled by default. That default does not eliminate the need to inspect SSH’s root-login setting, because an existing configuration or image may have changed it. Review PermitRootLogin alongside the user and group directives.
Use a named administrative account with sudo for testing and routine work. Do not test a new allow-list by closing your only root-capable session. If root login is permitted by the current policy, verify that the resulting behavior is intentional; if it is not, make the root-login decision explicit rather than assuming the distribution default.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Check included files and conditional blocks
Ubuntu may assemble the daemon configuration from the main file and included snippets. Search all of the files that the active configuration includes for AllowUsers, AllowGroups, DenyUsers, DenyGroups, PermitRootLogin, and Match. A second snippet can introduce a restriction you did not expect, while a conditional block can change authentication behavior for a particular address or user.
Read every Match block to understand which settings are conditional and where the block ends. Do not assume that a global rule has the same effect inside a conditional section. The effective configuration, rather than the line you most recently edited, is what the daemon will enforce.
Password locking does not revoke SSH keys
Locking an account’s password is useful for stopping password authentication, but it does not by itself stop remote login when the account already has an authorized SSH public key. Ubuntu explicitly warns that disabling or locking a password will not prevent remote login if the user previously configured public-key authentication.
When an account must lose SSH access, use an SSH policy restriction as well as credential cleanup:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Remove the account from the approved group, or add a narrowly scoped
DenyUsersorDenyGroupsexception. - Review and remove or disable the account’s authorized-key path according to your key-management process.
- Lock the password if password authentication should also be unavailable.
- Terminate existing sessions when the response must take effect immediately; authentication rules apply to new connections, not sessions that are already established.
Changing the login shell to a noninteractive shell can be an additional account-control measure, but it should not be treated as a replacement for the SSH allow/deny policy. Different SSH features can behave differently depending on the requested session or subsystem, so make the access decision at the SSH layer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validate before reloading SSH
A syntax error or an over-broad allow-list can disconnect you from the server. Perform validation while the current session remains open.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- Check the daemon configuration syntax with the installed OpenSSH test mode:
sudo sshd -tIf your system requires the full binary path, use the installed
sshdpath. The command should return no error text and a successful status. - Inspect the daemon’s expanded settings when you need to see what it will use:
sudo sshd -TUse the output to locate conflicting user, group, root-login, authentication, and included-file settings.
- Confirm the group data independently:
getent group sshlogin id aliceCheck that every intended administrator appears in the group and that an account meant to be denied does not.
- Open a second terminal and connect as an allowed, non-root administrator. Do not close the original session until this login succeeds and you can run the administrative command you need.
- Test a deliberately disallowed account from the same client or test host. The expected result is an SSH authorization failure, even if the account has a correct password or an authorized key.
- If source restrictions are configured, repeat the test from an approved address and from an unapproved address. A single successful test from one network does not prove that the CIDR boundary is correct.
Testing both outcomes catches the most dangerous mistakes: accidentally excluding every administrator and accidentally permitting an account that should be blocked.
Reload the service and record the change
After syntax and access tests pass, reload the SSH service so new connections use the policy:
sudo systemctl reload sshSome installations expose a differently named unit. Use the unit already managing the server rather than starting a second daemon. A reload normally preserves established sessions, which is why the original connection can remain available while you verify the new policy.
Record the configuration change, the group-membership change, the accounts tested, the source networks used, and the time of the reload. This gives the next administrator a clear explanation of why an account can or cannot connect and makes emergency rollback faster.
Troubleshoot common failure modes
| Symptom | Likely cause | Action |
|---|---|---|
An intended administrator is rejected after adding AllowGroups |
The account is not in the group seen by the daemon, or another allow/deny rule conflicts | Run id username, getent group groupname, and sudo sshd -T; inspect every included file and deny directive. |
A user can still connect after passwd -l |
Public-key authentication is still available | Remove the SSH key path or block the account with the SSH policy, then test a new connection. |
| The edited line appears correct but has no effect | You edited a file that is not included, or a conditional block changes the effective setting | Check the active include statements and compare them with sudo sshd -T. |
| SSH refuses to reload | A syntax error, invalid pattern, or unsupported setting exists | Run sudo sshd -t, correct the reported line, and do not reload until the test succeeds. |
| An account removed from the group remains connected | Existing sessions are not re-authenticated | Terminate the session through your normal incident or account-offboarding procedure, then verify a fresh login is rejected. |
| Only one network can connect | The USER@HOST pattern or CIDR does not include the actual source address |
Confirm the address observed by the server, correct the network pattern, validate again, and test from both sides of the boundary. |
Operational patterns that scale
Small personal server
Use AllowUsers with the two or three named administrators, review PermitRootLogin, and keep a console recovery path. This is simple to audit when the list rarely changes.
Team-managed server
Use a dedicated AllowGroups group. Make group membership the subject of onboarding and offboarding checks, and avoid adding broad groups such as a general “users” group unless every member truly needs SSH.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Jump-host or VPN-only administration
Combine a user or group allow-list with a source restriction such as USER@HOST and a CIDR range for the jump host or VPN. Test the address that the server actually sees; a local workstation address may be hidden behind the bastion.
Temporary suspension
For a short-term block, a documented DenyUsers or DenyGroups entry can provide an immediate, visible exception. Pair it with key and password review, set an owner and expiry date for the exception, and remove the rule when the suspension ends.
Final review checklist
- The policy uses
AllowGroupsorAllowUsersdeliberately, rather than relying on an undocumented default. - Any
DenyUsersorDenyGroupsexception is narrow, documented, and understood to run before allow checks. - All included configuration files and relevant
Matchblocks have been reviewed. PermitRootLoginreflects the intended root policy, and a non-root administrative account has been tested.- Password locking is not being mistaken for SSH-key revocation.
sudo sshd -tsucceeds before the service reload.- A second session proves that an allowed account can administer the server.
- A fresh connection proves that a disallowed account is rejected.
- The change, group membership, test results, and rollback path are recorded.
For most Ubuntu servers, a dedicated group with AllowGroups provides the best balance of least privilege and maintainability. Use AllowUsers when the population is genuinely small and fixed, add USER@HOST restrictions when network origin matters, and treat credential cleanup and session termination as separate parts of account offboarding.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
