I got a service that connects to a third-party SFTP site to pull files. The third-party has a system that when certain users try to connect, it automatically blocks the incoming IP. Someone is doing some connection attempts while using the forbidden user as due to be a legacy system, any user gets to the system as root. Whenever this individual tries the sftp root@remote-site he/she just breaks a couple of applications that rely on the same remote SFTP.

Question Is there any way with SSH to block this outgoing connection for a specific user@site? Match rule is for sshd_config which is basically incoming. Is there an equivalent for ssh client?

  • use ~user/.ssh/config to redirect outgoing ssh somehost to (I am not sure this will solve Y part of the XY-Problem)
    – Archemar
    Oct 1 '18 at 11:48

You have to use iptable, for example:

Block outgoing ssh connection for subnet

 iptables -I OUTPUT -d  -p tcp --dport 22 -j REJECT

Then verify

ssh -v
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to [] port 22.
debug1: connect to address port 22: **Connection refused**
ssh: connect to host port 22: **Connection refused**
  • Thanks but this blocks all connectios. Not what I am looking for. If ssh is done with ssh root@remote-site it gets blocked. if ssh user1@remote-site needs to work. The suggested solution blocks all.
    – BitsOfNix
    Oct 2 '18 at 6:03
  • @BitsOfNix "outgoing SSH connection from server" means block the whole connection! To block specific users. You can edit ssh_d config and add any user name you want to block under DenyUsers. Just do sudo vi /etc/ssh/sshd_config, then under DenyUsers add the user name you want to block. Let's say you want to block user mark then add DenyUsers mark. Let me know if this work or not so we can help further ;-)
    – user88036
    Oct 2 '18 at 10:20
  • @user88036 he wants to block all outgoing connections, not incoming connections.
    – dan
    Aug 31 '19 at 10:29

The Match rule for sshd_config works also for ssh_config, and in particular the global /etc/ssh/ssh_config file which you can edit to contain:

Match host site user root
 Hostname DontDoThat

This will replace the hostname when you do an ssh or sftp:

$ sftp root@site
Couldn't read packet: Connection reset by peer

$ sudo sftp site
ssh: Could not resolve hostname dontdothat: Name or service not known

Of course, the user's ~/.ssh/config file can still override this setting.

You might want to log information about the person doing the sftp by adding to the Match line a call of a script (that must exit 0), eg exec "/bin/mylogger somearg..." (don't use single quotes).

  • This is great. At least until we identify the user making the "malicious" outbound connection.
    – BitsOfNix
    Oct 2 '18 at 13:59

You can always allow outgoing SSH connection with iptables "user" module:

iptables -A OUTPUT -o eth0  -p tcp --destination-port 22 -m owner --uid-owner {USERNAME} -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --destination-port 22 -j DROP

This will block all outgoing ssh connections, but allow {USERNAME} to perform it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.