</sect2>

    <sect2>

      <title>AllowUsers - Controlling what users are allowed to login

        and from where</title>

      <para>It is often a good idea to only allow users to login from a

        certain host and not allow other users to login at all.

        AllowUsers is a good way to accomplish this. For example, to

        only allow the root user to login from <hostid

        role="ipaddr">192.168.1.32</hostid>, something like this would

        be appropriate for &man.sshd_config.5;:</para>

      <programlisting>AllowUsers root@192.168.1.32</programlisting>

      <para>To allow a user, admin, to login from anywhere, use a

        <quote>*</quote>:</para>

      <programlisting>AllowUsers admin@*</programlisting>

      <para>Multiple users will all be listed on the same line:</para>

      <programlisting>AllowUsers root@192.168.1.32 admin@*</programlisting>

      <note>

        <para>It is important that you list each user that needs to

          login to this machine, otherwise they will be locked out.</para>

      </note>

      <para>After making any changes to <filename>sshd_config</filename>

         you must restart &man.sshd.8; by running:</para>

      <programlisting>&prompt.root; killall -HUP sshd</programlisting>