I want to allow SSH for all users as normal except that I want to restrict root's access based on a set of IP addresses. So, users peter, paul, lary can login from anywhere, but root may login only from hosts a.b.c.d and q.r.s.t.

  • sshd_config's AllowUsers won't work for this. If I specify anything, then I must specify all users.
  • Unlike how the man pages suggest, AllowGroups is checked unconditionally, even if the user is whitelisted in AllowUsers; so if I tried to white list non-root users by putting them in a group, and then add the group to AllowGroups, the authentication will still fail because root is not in a valid allowed group.
  • sshd_config's DenyUsers might work if I can somehow whitelist the set of IPs root is otherwise denied from. If I had only one IP, it might work with the ! operator.
  • I can do this partially with the options key in the authenticated_keys file and by completely disabling the root password. The problem is that this file is not system-policy and may be overwritten by another (root-access) user. Currently, it's the best option I got, and I don't like it. Also, if I nuke the root password, someone in my group will be very angry with me. (If I don't nuke the root password, someone can login via root with the password from any IP.)
  • I tried to do this with PAM, specifically via pam_listfile, but my approach didn't seem to work at all:

    auth       required     pam_sepermit.so
    auth       required     pam_listfile.so file=/etc/root-whitelist.txt sense=allow item=rhost apply=root
    auth       include      password-auth

    Inside the root-whitelist.txt file was allowed IP addresses, line by line. I could not get the rule to deny non-listed IPs access.

Is the pam_listfile approach usable and I simply got it wrong? Is there a better way?


My work-colleague pointed me to the same direction as /u/meuh did, using a slightly different approach.

Match Address "172.24.*.33"
  PermitRootLogin yes
Match Address ","
  PermitRootLogin yes
  • Tested against normal users from all IPs (success expected, successful login), against root users from whitelist IPs (success expected, successful login), against root users from non-whitelisted IPs (fail expected, failed to login), and against a non-whitelisted IP which was then whitelisted (success expected, successful login) – Otheus Aug 31 '15 at 14:37

Depending on your version of ssh, you might be able to set a match condition around your AllowUsers. man sshd_config lists the allowed commands under Match. If AllowUsers is in there, you might try the following.Make sure it is at the end of the file.

Match User root
 AllowUsers root@ a.b.c.d root@q.r.s.t

Eg, not in OpenSSH_6.0p1 Debian, but ok in OpenSSH_6.6.1p1 Ubuntu.

  • On our RHEL6 based system, sshd is OpenSSH_5.3p1, and "AllowUsers" is not allowed in a Match block. Tsk. But great idea! – Otheus Aug 31 '15 at 14:37

Another work-colleague pointed me in the direction of the pam_access module. This uses the format typically found in /etc/security/access.conf, but any file can be specified; it can be enabled for the entire system, or only the sshd process. I haven't tried this, but presumably I can set up pam_access using the defaults (on RHEL) by adding it to the auth section in /etc/pam.d/sshd. Then the access.conf file looks like this:

+ : root : hosta hostb hostx
- : root : ALL

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.