There are always a lot of bots trying to access to every vps, even when it's just registered right now, and no matters how many ips you ban, they will keep trying.

so can I just allow ssh access entering a domain which points to my vps instead of entering the ip? something similar like virtualhosts work.

I doubt about it, since even when you connect entering a domain, it resolves the pointed ip address, so it wouldn't connect in case I deny connection via IP...

so would be another way to make my idea possible?

  • 1
    Allow only access via VPN to ssh servers. security.stackexchange.com/questions/110706/… – Rui F Ribeiro Oct 3 '16 at 11:43
  • Yea, it's a really good solution but im looking for other alternatives – Mc Kernel Oct 3 '16 at 11:52
  • It dependes on how many machines you have got. I even do at home VPN for the couple of servers I have. At work, I have a VPN in a VM+a jumpbox. The jumpbox can be your VPN in a smaller infra-structure or if you choose it, strongswan in Linux. No need to esoteric or expensive hardware. You also have got port knocking. Not the best solution from the security point of view but good enough. – Rui F Ribeiro Oct 3 '16 at 11:55
  • Hmm, rereading the question, I'm not really sure what you ask. Do you mean that connections should only succeed if the clients knows the "virtual host name" of the host, instead of just connecting with an IP without knowing the name? That might be hard since I don't think the SSH protocol knows about "virtual hosts", but you might do some obscurity like that by using unpredictable usernames (and putting the server in another port) – ilkkachu Oct 3 '16 at 12:09
up vote 0 down vote accepted

I'm not exactly sure if this is what you mean, but yes, you can define the allowed client hosts by hostname.

Option 2 is to use AllowUsers in sshd_config, it supports an optional hostname, here we allow someone to access only from foo.bar.com:

AllowUsers ilkka@foo.bar.com

(ssh_config(5) documents the allowed hostname patterns)

The other option is to use hosts.allow and hosts.deny (tcpwrapper). To only allow ssh from foo.bar.com.

# hosts.allow
sshd: foo.bar.com

# hosts.deny
sshd: ALL

I think at least sshd should check that the client IP's reverse domain lookup matches the forward lookup for that name, but I'm not sure.

  • I added these 2 lanes to sshd_config and restarted the service: DenyUsers * AllowUsers root@mydomain.com it denies to connect entering the IP as I asked... but also denies to connect entering the domain, lol. – Mc Kernel Oct 3 '16 at 15:11

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.