Home / server / Questions / 117965
In Process
Keith Palmer Jr.
Asked: 2010-03-02 09:35:38 +0800 CST

Restrict SSH login from a specific user to a specific IP address

  • 772

I'd like to restrict SSH logins for a specific FreeBSD user account to a specific IP address (they're automated rsync backups from one machine to another, no actual user should ever be logging in, just the SSH+rsync process).

I feel like I should be able to do this using either hosts.allow or sshd_config... but I can't find any clear-cut example for how to do this. Can anyone tell me?

ssh

3 Answers

  1. In addition to the wrappers option....I imagine this rsync backup is making use of an ssh key. You can restrict a key to a specific source IP or domain. This would be equivalent to a user-to-IP restriction since only that user is making use of that key (if your smart, which you appear).

    First line of authorized_keys file:

    from="trusted.domain.com",no-port-forwarding,no-pty ssh-rsa AAAABasdf

    • 4

  2. From the hosts.allow manpage:

    CLIENT USERNAME LOOKUP
       When the client host supports the RFC  931  protocol  or  one  of  its
       descendants  (TAP,  IDENT, RFC 1413) the wrapper programs can retrieve
       additional information about the owner of a connection.  Client  user-
       name  information,  when available, is logged together with the client
       host name, and can be used to match patterns like:

          daemon_list : ... user_pattern@host_pattern ...
    • 0

  3. It is also possible to restrict the remote IP address in the sshd_config file, e.g. for root access:

    PermitRootLogin no
Match Address 10.0.1.0/24
     PermitRootLogin prohibit-password

    The options AllowUsers, AllowGroups, DenyUsers, DenyGroups can be used for restrictions as well, e.g.:

    AllowGroups group1
Match Address 10.0.1.0/24
    AllowGroups group1 group2

    The sshd_config manpage section Match has a detailed list of allowed options and description.

    • 0