2

I can see on my server where SSH outbound connections are being created in high amount. Will it be possible to block the ssh command for all the users except one specific user.

Or

Will it be possible to block SSH outbound connection for all the ports except port 22 through iptable? but these ports should be allowed for other processes. Only all the ports (except 22) should be blocked for SSH Outbound connection.

Note : I executed the netstat |grep ssh and below is the output where you can see ssh connection is being created for different IP with different ports. where 10.25.218.4 is my server IP address.

root@ubuntu:/var/log# netstat | grep ssh

tcp        0      1 10.25.218.4:ssh         222.186.31.204:25262    FIN_WAIT1
tcp        0      0 10.25.218.4:ssh         host-92-0-218-178.:1834 ESTABLISHED
tcp        0      0 10.25.218.4:ssh         host-92-0-218-178:14717 ESTABLISHED
tcp        0      0 10.25.218.4:ssh         222.186.31.204:41642    ESTABLISHED

Output of netstat -np | grep -E 'Local|:22\b'

I can see one unexpected connection with PID 23909 and can see the different-2 PID every time for same same foreign IP Address.

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0     64 10.25.218.4:22          92.0.218.178:7341       ESTABLISHED 22943/sshd: rsantos
tcp        0      0 10.25.218.4:22          92.0.218.178:1834       ESTABLISHED 11378/sshd: rsantos
tcp        0      0 10.25.218.4:22          222.186.42.155:10064    ESTABLISHED 23909/sshd: unknown
4
  • These aren't necessarily outbound connections. Try netstat -np | grep -E 'Local|:22\b' to see what process owns each connection. (Add the result to your question if you need help interpreting it.) Commented May 29, 2020 at 19:22
  • 2
    I don't think those are outbound connections. It would mean they all use a source port of 22, which would be odd. If you have a publicly available SSH server running, then it would be expected to have a large number of random connections to it. As long as you don't allow root access through SSH and don't allow password authentication, there shouldn't be too much to worry about. If you want to do something about it, consider running your SSH server on another port than 22, or use sshguard or fail2ban.
    – Kusalananda
    Commented May 29, 2020 at 19:31
  • Possibly related: unix.stackexchange.com/questions/585342/…
    – Kusalananda
    Commented May 29, 2020 at 19:34
  • roaima - I have added the output with my observation.
    – sumit vedi
    Commented May 29, 2020 at 19:54

1 Answer 1

0

Your problem seems not to be what the question title suggests. Answering the question title, though:

Under the assumption that the only way to create SSH connections is to call ssh, scp, or sftp, you can do this:

  1. Create a group sshclient
  2. Chage the group of those binaries to sshclient
  3. Change the permissions of those binaries to 750
  4. Add the users you want to allow using SSH to that group

This is not firewall-related.

You can allow the other user users using SSH in a firewall-controlled manner by putting wrapper scripts with those names earler in $PATH which executes the binary via sudo as the same user (keeping the environment) but with the group sshclient added to that process. Then you can use the iptables module owner for selecting all packets which belong to the group sshclient (which can be only SSH packets).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .