sudo sed -i 's/^#AllowUsers.*/AllowUsers deploy/' /etc/ssh/sshd_config
Restrict SSH logins to named users only
AllowUsers whitelists which accounts may log in over SSH — here only deploy — so every other user (including root) is refused even with a valid key. It is defense in depth after PermitRootLogin no. Keep the setting commented out on hosts where LDAP or other tools manage access.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.