0

I'm trying to learn Linux and get familiar with it. How do I block all IPs except two certain IPs on different subnets for SSH/SSHD? I've been trying to Google for an answer but nothing seem to work out for me!

  • 1
    Which environment is this? what have you tried so far, and why it doesn't work for your case? – AlvaroGMJ Jan 16 '18 at 17:57
  • I'm using Centos07, I've tried pretty much everything in the first 10 to 20 results on Google while looking for "how to restrict SSH access after 5 attempts" and other search queries.. – user270860 Jan 16 '18 at 18:14
  • ok, and why those things don't work for you? certainly fail2ban should be the correct answer to the question – AlvaroGMJ Jan 16 '18 at 18:21
  • i'm not sure what to do to get it to work, hence the question – user270860 Jan 16 '18 at 18:38
  • @user270860, your question says you want to just block based on IP addresses, but in your comment you also mention "restricting after 5 attempts". So what is it you want? Also, it would help if you could show some of the solutions that don't work for you. – ilkkachu Jan 16 '18 at 20:21
0

To your main question,

How do I block all IPs except two certain IPs on different subnets for SSH/SSHD?

Using iptables simply replace the 192.168.0.1/24 with whatever IP/Subnet you need to allow. Make sure to append the last rule. As rules are read from top to bottom, adding it first will lock you out if you are remoting in to your system

iptables -I INPUT -s 192.168.0.1/24 -p tcp --dport 22 -j ACCEPT
iptables -I INPUT -s 192.168.0.1/24 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

In regards to your second question,

how to restrict SSH access after 5 attempt

Append or modify the existing MaxAuthTries parameter in your ssh config:

echo "MaxAuthTries 5" >> /etc/ssh/sshd_config

This will deny login after 5 failed attempts and any attempts after half the value (3 attempts in this case) will be logged.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.