3

How can I limit ssh login for a specific user to be allowed from just one IP address?

I have a user named foo in server with e.g. IP address 127.0.0.5 (my first server) and I left its login via ssh only by public key. I want to only grant access login to this user from a specific IP (which is my another server), e.g. IP 127.0.0.6.

How is it possible?

1

2 Answers 2

2

You can change the configuration of sshd, in /etc/ssh/sshd_config:

AllowUsers [email protected] [email protected] ....

You can also select that some user can use only some authentication methods:

Match User my_login
AuthenticationMethods publickey

But carefully on both points: you should have physical control or being very carefully before changing any settings. And I recommend you also to look the manual page for AllowUsers ans AuthenticationMethods options, in order to understand better the implications, and eventually additionally options and methods you need.

0

You could set up a firewall and allow only a certain IP to connect to port 22:

/etc/nftables.conf

#!/usr/sbin/nft -f

flush ruleset

table inet firewall {

    chain inbound {
        # By default, drop all traffic unless it meets a filter
        # criteria specified by the rules that follow below.
        type filter hook input priority 0; policy drop;

        # Allow traffic from established and related packets.
        ct state established,related accept

        # Drop invalid packets.
        ct state invalid drop

        # Allow loopback traffic.
        iifname lo accept

        # Allow all ICMP and IGMP traffic, but enforce a rate limit
        # to help prevent some types of flood attacks.
        ip protocol icmp limit rate 4/second accept
        ip6 nexthdr ipv6-icmp limit rate 4/second accept
        ip protocol igmp limit rate 4/second accept

        # Allow SSH on port 22 but only from 127.0.0.6
        ip saddr 127.0.0.6 tcp dport 22 accept
    }

    chain forward {
        # Drop everything (assumes this device is not a router)
        type filter hook forward priority 0; policy drop;
    }

    chain outbound {
        # Allow all outbound traffic
        type filter hook output priority 0; policy accept;
    }
}
1
  • I want to limit ssh login for a specific user what you suggest limit ssh port for login Commented Aug 20, 2020 at 13:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .