Restricting ssh

[Timothy Murphy]

I have an sshd server running on a machine in Ireland.

Can I configure it so that it only accepts connection
from certain machines, wherever they may be in the world?


-- 
Timothy Murphy  
e-mail: gayleard /at/ eircom.net
tel: [phone]
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

[Pittigher, Raymond - ES]

You can use iptables or you can configure sshd config
-
Ray Pittigher
Software Development Environment Department
--phone [phone]
--email raymond.pittigher(a)itt.com

http://acdnjpvcs/tmtrack/tmtrack.dll for all your SDE Support needs

________________________________________
From: users-bounces(a)lists.fedoraproject.org [users-bounces(a)lists.fedoraproject.org] On
Behalf Of Timothy Murphy [gayleard(a)eircom.net]
Sent: Thursday, January 06, 2011 6:28 PM
To: users(a)lists.fedoraproject.org
Subject: Restricting ssh

I have an sshd server running on a machine in Ireland.

Can I configure it so that it only accepts connection
from certain machines, wherever they may be in the world?


--
Timothy Murphy
e-mail: gayleard /at/ eircom.net
tel: [phone]
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

--
users mailing list
users(a)lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

This e-mail and any files transmitted with it may be proprietary and are intended solely
for the use of the individual or entity to whom they are addressed. If you have received
this e-mail in error please notify the sender.
Please note that any views or opinions presented in this e-mail are solely those of the
author and do not necessarily represent those of ITT Corporation. The recipient should
check this e-mail and any attachments for the presence of viruses. ITT accepts no
liability for any damage caused by any virus transmitted by this e-mail.

[Timothy Murphy]

On Friday, January 07, 2011 12:40:24 am Pittigher, Raymond - ES wrote:

> > Can I configure it [sshd] so that it only accepts connection
> > from certain machines, wherever they may be in the world? 
>  You can use iptables or you can configure sshd config 
How and how?

-- 
Timothy Murphy  
e-mail: gayleard /at/ eircom.net
tel: [phone]
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

[Frank Cox]

On Fri, 07 Jan 2011 00:28:47 +0100
Timothy Murphy wrote:

>  Can I configure it so that it only accepts connection
>  from certain machines, wherever they may be in the world? 
Set ssh to accept only keys and not passwords.   Install a key on each
authorized computer.   Done.

You can also run sshd on a port that isn't 22, which will cut down on the
entries in your log file.

-- 
MELVILLE THEATRE ~ Melville Sask ~ www.melvilletheatre.com
www.creekfm.com - FIFTY THOUSAND WATTS of POW WOW POWER!

[Timothy Murphy]

On Friday, January 07, 2011 12:41:39 am Frank Cox wrote:

>  > Can I configure it [sshd] so that it only accepts connection
>  > from certain machines, wherever they may be in the world?
>  
>  Set ssh to accept only keys and not passwords.   Install a key on each
>  authorized computer.   Done. 
Thanks for your response.
But could you explain more fully how to do this.
I find sshd_config more or less unintelligible.

>  You can also run sshd on a port that isn't 22, which will cut
> down on the
>  entries in your log file. 
I do that already.

-- 
Timothy Murphy  
e-mail: gayleard /at/ eircom.net
tel: [phone]
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

[Sam Varshavchik]

Timothy Murphy writes:

>  I have an sshd server running on a machine in Ireland.
>  
>  Can I configure it so that it only accepts connection
>  from certain machines, wherever they may be in the world? 
In sshd_config set:

PasswordAuthentication no

Then, on the machines that you wish to allow connections from, in each 
account you wish to connect, run ssh-keygen to generate a keypair. This will 
create id_rsa and id_rsa.pub (or id_dsa and id_dsa.pub) in $HOME/.ssh (with 
permissions set appropriately), then append the contents of id_rsa.pub or 
id_dsa.pub to the $HOME/.ssh/authorized_keys2 file on the server that you 
want to connect TO.

Now, only the accounts whose private keys are listed in authorized_keys2 
will be able to log in to your server. And, as an added bonus, no password 
will be required. The key takes place of the password, and only the machine 
where the key is installed will be able to log in.

[Donald Russell]

On Thu, Jan 6, 2011 at 15:45, Sam Varshavchik <mrsam(a)courier-mta.com&gt; wrote:

>  Timothy Murphy writes:
>
>   I have an sshd server running on a machine in Ireland.
> >
> > Can I configure it so that it only accepts connection
> > from certain machines, wherever they may be in the world?
> >
>
>  In sshd_config set:
>
>  PasswordAuthentication no
>
>  Then, on the machines that you wish to allow connections from, in each
>  account you wish to connect, run ssh-keygen to generate a keypair. This will
>  create id_rsa and id_rsa.pub (or id_dsa and id_dsa.pub) in $HOME/.ssh (with
>  permissions set appropriately), then append the contents of id_rsa.pub or
>  id_dsa.pub to the $HOME/.ssh/authorized_keys2 file on the server that you
>  want to connect TO.
>
>  
There are ssh commands that make that process even easier...
Once you have your public/private key pair...

eval $(ssh-agent)
ssh-add
ssh-copy-id <remote system>

You'll be prompted for the password at the remote system so it can copy the
keys across, if that's successful, you won't need the password anymore.

I added these to my ~/.bash_profile
eval $(ssh-agent)
ssh-add

I get prompted once for my ssh key passphrase and after that I don't get
prompted for password anymore for the systems I ssh to.
(You can also not use an ssh key passphrase but I'm not quite that
paranoia-free. :-)

[Tom Horsley]

On Fri, 07 Jan 2011 00:28:47 +0100
Timothy Murphy wrote:

>  Can I configure it so that it only accepts connection
>  from certain machines, wherever they may be in the world? 
I've setup iptables to drop just about everything, then
I have (among others) an /etc/sysconfig/iptables entry like this:

-A INPUT -s NNN.NNN.NNN.NNN/32 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

Which allows just the IP NNN.NNN.NNN.NNN access to connect to
my ssh server (where in my case the IP address is the IP of
my company's firewall, so I can connect from work - of course
anyone else at work will look like they are coming from
the same IP, but I also use public keys for authentication).

[Markus Schönhaber]

07.01.2011 00:28, Timothy Murphy:

>  I have an sshd server running on a machine in Ireland.
>  
>  Can I configure it so that it only accepts connection
>  from certain machines, wherever they may be in the world? 
Among other things already mentioned you could turn off all
*Authentication options in sshd_config and append a Match block matching
addresses or host names where you turn the relevant ones back on. For
example, something like

[...]
PasswordAuthentication no
PubkeyAuthentication no
[...]
Match Address x.y.z.w
PubkeyAuthentication yes

-- 
Regards
  mks

[Mike Zingale]

2011/1/7 Markus Schönhaber <fedora-users(a)list-post.mks-mail.de&gt;:
>  07.01.2011 00:28, Timothy Murphy:
>
> > I have an sshd server running on a machine in Ireland.
> >
> > Can I configure it so that it only accepts connection
> > from certain machines, wherever they may be in the world?
>  
I uses /etc/hosts.deny and /etc/hosts.allow to do this.  In
/etc/hosts.deny I have

ALL:ALL

(though, you might want it to just be sshd: ALL).

Then in hosts.allow, I have a line like

sshd: .domain.com

for each of the domains or machines I want to grant access.  This
seems to work well.

[Roger K. Wells]

On 01/07/2011 10:49 AM, Mike Zingale wrote:
>  2011/1/7 Markus
> Schönhaber<fedora-users(a)list-post.mks-mail.de>:
> > 07.01.2011 00:28, Timothy Murphy:
> >
> >> I have an sshd server running on a machine in Ireland.
> >>
> >> Can I configure it so that it only accepts connection
> >> from certain machines, wherever they may be in the world?
>  I uses /etc/hosts.deny and /etc/hosts.allow to do this.  In
>  /etc/hosts.deny I have
>
>  ALL:ALL
>
>  (though, you might want it to just be sshd: ALL).
>
>  Then in hosts.allow, I have a line like
>
>  sshd: .domain.com
>
>  for each of the domains or machines I want to grant access.  This
>  seems to work well. 
a variation on the theme:
in
/etc/hosts/allow
the line
ALL:LOCAL /etc/hosts

will limit access to the contents of the hosts file


-- 
Roger Wells, P.E.
SAIC
221 Third St
Newport, RI 02840
401-847-4210 (voice)
401-849-1585 (fax)
roger.k.wells(a)saic.com