How to limit ssh access for localhost only?

Question

I need to forbid ssh access (except localhost) for specified user.

So. ssh localhost should work. ssh hostname from outside should not work for that user.

All other users should work as usual.

Thanks.

Answer 1

See the AllowUsers and DenyUsers directives of the sshd_config man page (and possibly also AllowGroups and DenyGroups).

Basically these directives take a list of user patterns in the user@host format separated by spaces. Directives have the following precedence: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

For the simple case of just allowing a specific user from localhost, only the following line should be added:

AllowUsers user@localhost

This will implicitly deny any user from anywhere that isn't user@localhost.

Answer 2

How about if you force public key authentication for the specific user, and then restrict his public key with a from= option in the authorized keys file.

To force a specific user to use public key authentication:

Match User Bad_User
    PasswordAuthentication no
    AuthorizedKeysFile /somewhere/the/user/cannot/touch

And then in the authorized keys file configure his key like this:

from=localhost ssh-rsa AAAA...

You can read more about Match directives in man sshd_config, and about authorized keys options in man sshd.

Answer 3

You could use PAM (UsePAM in sshd_config) and add

account  required     pam_access.so

to the PAM configuration for ssh.

Then you can define access policies in /etc/security/access.conf

+ : john : 127.0.0.1 ::1
- : john : ALL
+ : ALL : ALL

(untested)