Re: ip access control | sshd_config

cooch17_at_NOSPAMverizon.net
Date: 03/27/05

  • Next message: Michael Heiming: "Re: ip access control | sshd_config" 
    Date: Sun, 27 Mar 2005 13:07:29 -0500

    On Sat, 26 Mar 2005 00:48:51 +0100, Michael Heiming
    <michael+USENET@www.heiming.de> wrote:

    >In comp.os.linux.security cooch17@nospamverizon.net:
    >> Greetings -
    >
    >> While I can use AllowUsers in sshd_config to control which users with
    >> valid accounts can access one of my boxes via ssh, I'm wondering if
    >> there is a way to specify a list of ip addresses which are allowed to
    >> access sshd? I've searched around a bit, but didn't find anything that
    >> looked like what I've described.
    >
    >Use/compile a sshd version with tcp_wrapper support enabled and
    >try 'man 5 hosts_access' for setup.
    >
    >Alternatively or/and in addition fire up iptables and allow access
    >to port 22 only to the system you want.
    >

    That does the trick - plus not allowing root access to sshd. Most of
    the time, the script kiddies are trying to burrow in by guessing a
    username on the system. root is about the only one you know is on any
    system, so no t allowing root to access sshd minimizes that problem.

    Question though -

    if I restrict access to a certain ip in access.allow, then what
    advantage is there in also setting up what looks to be essentially the
    same thing in iptables? I'm embarassed to admit I've always puzzled
    over things such as this...

    Thanks...

  • Next message: Michael Heiming: "Re: ip access control | sshd_config"

    Relevant Pages

    • Re: Cant ping into or outof Redhat box
      ... There is no host from an arp -n command, ... and neither computer will load iptables. ... | Your basic network setup is not right, ...
      (comp.os.linux.networking)
    • Re: Cant ping into or outof Redhat box
      ... There is no host from an arp -n command, ... and neither computer will load iptables. ... | Your basic network setup is not right, ...
      (linux.redhat)
    • Re: Is there any way to set iptables as a non-root user?
      ... > iptables as a non root user of the computer. ... User 'root' is there for special tasks (such as ... Newbies in Linux world are often afraid of root account, ... forget about running iptables from account other than root, ...
      (comp.os.linux.security)
    • Kornets Last Hack
      ... I was going thru logs today and I found that some asshole from Thrunet ... script and run it for iptables. ... Hint: We don't allow 'root'. ...
      (comp.os.linux.security)
    • RH 8.0 gateway and iptables
      ... then the kernel was recompiled in such a way the iptables support might ... I am faced with a RH 8.0 based install with a recompiled kernel (to ... [root@Gateway root]# iptables --version ... root@Gateway root]# ifconfig eth0 ...
      (comp.os.linux.security)