Re: allow login from specific address

Sylvain Ferriol <sferriol@xxxxxxx> writes:

hello

i want to config a ssh gateway between internet and my intranet:
the specifications are:
- a user from internet can not login the ssh_gateway
- some users (admins) from intranet can login the ssh_gateway

how can i do that ?
can i allow sshd to accept login only from an ip address range ?

is it more secure to only accept port forwarding on ssh_gateway ?

TCP Wrappers rather than an sshd config is the place to do this.

THe 30 second tutorial, assuming it's installed:

edit /etc/hosts.deny
Make this the one and only line:
sshd: ALL

Or, if you want to get more restrictive and don't host external
services on the box make that:
ALL:ALL

which denies everything by default except things specifically
allowed.

Next, edit /etc/hosts.allow

Add lines
sshd: ip.address.to.allow.here
sshd: ip.address2.to.allow.here
sshd: ip.address3.to.allow.here
sshd: ip.address4.to.allow.here
sshd: intranet.mycompany.com

Man hosts.allow for more details and different ways to specify ip
ranges and subnets. If your intranet hosts reverse resolve to a
consistent name e.g. host123.intranet.mycompany.com, then sshd:
intranet.mycompany.com would be your hosts.allow entry.

Best Regards,
--
Todd H.
http://www.toddh.net/
.

Relevant Pages

  • Re: sshd attacks
    ... but if you know the usernames you want you could use ... > from your sshd server before anyone can break your encryption. ... > taht finds open sshd services and tests common user names and password. ... You could also do something where you login with PK to an account whose ...
    (comp.unix.bsd.freebsd.misc)
  • Re: allow login from specific address
    ... i want to config a ssh gateway between internet and my intranet: ... some users from intranet can login the ssh_gateway ... TCP Wrappers rather than an sshd config is the place to do this. ...
    (comp.security.ssh)
  • Re: strange and serious problem about user login
    ... > any service other than root. ... > and I try to login as normal user except root, ... > and when I start sshd in this pc, I get no errors, but when I check ...
    (Fedora)
  • Signal 1, Name stays on "who" list under Linux
    ... I'm not too sure if this is off topic, it might be a bug in sshd which is ... OpenSSH v3.4p1, SSH protocols 1.5/2.0 ... 1> connect to the linux box via SSH client and login as any user ... To get past step 2 you have to enter root password, ...
    (comp.security.ssh)
  • Re: autoblocking many ssh failed logins from the same IP....
    ... > daemon) to stop accepting login attempts from a given IP if it tries ... > actually just read the man pages and figure out how to get sshd to ... You can have multiple AllowUsers entries if you want more than one user ... To unsubscribe, ...
    (freebsd-questions)
Quantcast