1

Question is: How do we only allow specific users coming from either their domain or using our domain in an appropriate way (SSH/SFTP)? E.G.

jonnycustomer@ourdomain.com coming from customersIPaddress is Denied
and
jonnycustomer@ourdomain.com coming from randomIPaddress is not allowed
and
jonnycustomer@ourotherdomain.com is not allowed

In Centos 7, our sshd_config has this additional config:

Match Address 192.168.1.0/24
        AllowUsers bob trev
Match Address *,!192.168.1.0/24
        AllowGroups sftpgroup
Match All
PermitRootLogin no

sftpgroup is a group of our customers, that have their own root directories. but the above config UNFORTUNATELY Allows our customers' "employees" to login from unknown ip addresses, and it also allows them to use one of our other domains to login.

I tried this, and external users/groups stopped working:

Match Address 192.168.1.0/24
    AllowUsers bob trev
Match Address *,!192.168.1.0/24
    AllowUsers customer1@ourdomain.com
    AllowGroups sftponly
Match All
PermitRootLogin no

NB: bob and trev are our employees who only access from internally (they are not in the sftpgroup)

1

You could roll back your sshd_config changes and simply use /etc/hosts.allow. On your distro it could be /etc/hosts.allow and /etc/hosts.deny.

For example, with FreeBSD you would use:

sshd : <ip of allowed> : allow
sshd : <another ip> : allow
sshd : ALL : deny

Be sure to add the deny rule at the end!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.