6

  1. I would like to login to root via ssh directly while at home (192.168.1.0/24).

  2. But while outside (e.g. at work), I can still login via ssh by using one of the custom accounts I created.

I jus tried:

Match Address 192.168.1.0/24
        PermitRootLogin yes

and now I'm completely locked out of the box. I can't login while at work and from home as well (I sshed into my other FreeBSD box).

Any ideas on how this can be done? Thank you

Improve this question
1
  • see IP spooking, for why privileging IP addresses, from non-local fire-walled networks is a bad idea.
    – ctrl-alt-delor
    Aug 17, 2015 at 5:41

2 Answers 2

Reset to default
10

Check out the AUTHORIZED_KEYS FILE FORMAT section of the sshd man page. Then add something like the following to ~root/.ssh/authorized_keys (where the ssh-ed25519 ... part is replaced by your ssh public key):

from="192.168.1.0/24" ssh-ed25519 AA...

Then that key will only be allowed from your particular network.

Also, make sure you have the following in sshd_config:

PermitRootLogin prohibit-password
Improve this answer
1
  • very powerful! should be used like this to secure root ssh access from="127.0.0.1,::1",no-X11-forwarding ssh-dss AA.... Needs a separate SSH user without any other right.
    – Preexo
    Aug 17, 2015 at 6:48
4

The configuration change you made means "allow root from 192.168.1.0/24, deny everything else". In other words, only the conditions that match are allowed access.

You could try this instead:

AllowUsers [email protected].? anotheruser1 anotheruser2

That means root from 192.168.1.0/24, and the other two users from anywhere.

Improve this answer
1
  • seems to work. at the very least it didn't lock me out! I'll try the 1st requirement once I get home. Thank you :)
    – mrjayviper
    Aug 17, 2015 at 2:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .