diff --git a/roles/common/templates/sshd_config_Debian-8.j2 b/roles/common/templates/sshd_config_Debian-8.j2
index 3eebdcf..1280d8c 100644
--- a/roles/common/templates/sshd_config_Debian-8.j2
+++ b/roles/common/templates/sshd_config_Debian-8.j2
@@ -90,8 +90,5 @@ Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.
 MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com
 KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
 
-{% if ssh_allowed_users is defined and ssh_allowed_users %}
-# Is there a list of allowed users?
-# Is it populated? (An empty list is 'None', which evaluates as False in Python)
-AllowUsers {{ ssh_allowed_users }} provisioning
-{% endif %}
+# only allow shell access by provisioning user
+AllowUsers {{ provisioning_user.name }}
diff --git a/roles/common/templates/sshd_config_Ubuntu-14.04.j2 b/roles/common/templates/sshd_config_Ubuntu-14.04.j2
index 62a52b3..305f73b 100644
--- a/roles/common/templates/sshd_config_Ubuntu-14.04.j2
+++ b/roles/common/templates/sshd_config_Ubuntu-14.04.j2
@@ -90,8 +90,5 @@ Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.
 MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com
 KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
 
-{% if ssh_allowed_users is defined and ssh_allowed_users %}
-# Is there a list of allowed users?
-# Is it populated? (An empty list is 'None', which evaluates as False in Python)
-AllowUsers {{ ssh_allowed_users }} provisioning
-{% endif %}
+# only allow shell access by provisioning user
+AllowUsers {{ provisioning_user.name }}
diff --git a/roles/common/templates/sshd_config_Ubuntu-15.04.j2 b/roles/common/templates/sshd_config_Ubuntu-15.04.j2
index 3eebdcf..1280d8c 100644
--- a/roles/common/templates/sshd_config_Ubuntu-15.04.j2
+++ b/roles/common/templates/sshd_config_Ubuntu-15.04.j2
@@ -90,8 +90,5 @@ Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.
 MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com
 KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
 
-{% if ssh_allowed_users is defined and ssh_allowed_users %}
-# Is there a list of allowed users?
-# Is it populated? (An empty list is 'None', which evaluates as False in Python)
-AllowUsers {{ ssh_allowed_users }} provisioning
-{% endif %}
+# only allow shell access by provisioning user
+AllowUsers {{ provisioning_user.name }}