6
  1. I would like to login to root via ssh directly while at home (192.168.1.0/24).

  2. But while outside (e.g. at work), I can still login via ssh by using one of the custom accounts I created.

I jus tried:

Match Address 192.168.1.0/24
        PermitRootLogin yes

and now I'm completely locked out of the box. I can't login while at work and from home as well (I sshed into my other FreeBSD box).

Any ideas on how this can be done? Thank you

  • see IP spooking, for why privileging IP addresses, from non-local fire-walled networks is a bad idea. – ctrl-alt-delor Aug 17 '15 at 5:41
10

Check out the AUTHORIZED_KEYS FILE FORMAT section of the sshd man page. Then add something like the following to ~root/.ssh/authorized_keys (where the ssh-ed25519 ... part is replaced by your ssh public key):

from="192.168.1.0/24" ssh-ed25519 AA...

Then that key will only be allowed from your particular network.

Also, make sure you have the following in sshd_config:

PermitRootLogin prohibit-password
  • very powerful! should be used like this to secure root ssh access from="127.0.0.1,::1",no-X11-forwarding ssh-dss AA.... Needs a separate SSH user without any other right. – Preexo Aug 17 '15 at 6:48
4

The configuration change you made means "allow root from 192.168.1.0/24, deny everything else". In other words, only the conditions that match are allowed access.

You could try this instead:

AllowUsers root@192.168.1.? anotheruser1 anotheruser2

That means root from 192.168.1.0/24, and the other two users from anywhere.

  • seems to work. at the very least it didn't lock me out! I'll try the 1st requirement once I get home. Thank you :) – mrjayviper Aug 17 '15 at 2:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.