# Limiting SSH access to ThinLinc server

**URL:** <https://community.thinlinc.com/t/limiting-ssh-access-to-thinlinc-server/942>\
**Category:** Community Support\
**Tags:** ssh\
**Created:** [14 May 2024 15:43 UTC](https://community.thinlinc.com/t/limiting-ssh-access-to-thinlinc-server/942 "2024-05-14T15:43:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![assimilate](https://avatars.discourse-cdn.com/v4/letter/a/74df32/32.png) [@assimilate](https://community.thinlinc.com/u/assimilate)\
**Post date:** [14 May 2024 15:43 UTC](https://community.thinlinc.com/t/limiting-ssh-access-to-thinlinc-server/942/1 "2024-05-14T15:43:40Z")

</div>

Hello, I’m trying to figure out how to limit users from being able to access my vsmserver via direct SSH, but still allow them to connect to agents via the ThinLinc client.

The intention being that only my user accounts that administer the “master server” should be able to have direct access. However, when I limit the users able to ssh via sshd\_config, it causes all other users to be unable to access ThinLinc with a failed password error.

I’ve referred to “Disabling SSH access” in [this document](https://www.cendio.com/resources/docs/tag/lockdown.html?highlight=ssh), but all it seems to indicate is configuration for restricting access via SSH to the machines in my subcluster.

I tried to find it, but what is the proper way to limit ssh access without affecting ThinLinc from being able to connect users to my agents in the subcluster? Would utilizing the " Using ForceCommand" section of the article get me the results I want when done on the vsmserver?

---

<div class="post-metadata">

**Author:** ![aaron](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/aaron/32/13_2.png) [@aaron](https://community.thinlinc.com/u/aaron)\
**Post date:** [14 May 2024 22:03 UTC](https://community.thinlinc.com/t/limiting-ssh-access-to-thinlinc-server/942/2 "2024-05-14T22:03:35Z")

</div>

Hi,

Did you try setting the users’ shell to `/usr/bin/thinlinc-login` as described in the documentation? This has a few caveats (see below) but should achieve what you’re looking for, as long as you don’t make this change for users who require a login shell via SSH:

> Note that this method prevents any terminals inside the session from functioning as well. In most cases it also does not prevent users from running custom scripts and shell commands as they can use a text editor to construct such scripts.