7

I want to allow SSH logins only from 3 IP addresses: 111.111.111.111 and 222.222.222.222 and 333.333.333.333. I know, I have to edit /etc/hosts.allow and /etc/hosts.deny files.

My question is about the content of these files. I have seen different variants:

# /etc/hosts.allow

Variant 1:

sshd: 111.111.111
sshd: 222.222.222
sshd: 333.333.333

Variant 2:

sshd: 111.111.111, 222.222.222, 333.333.333

Variant 3: (without commas):

sshd: 111.111.111 222.222.222 333.333.333

Variant 4 (with sshdfwd-X11):

sshd,sshdfwd-X11: 111.111.111 222.222.222 333.333.333

/etc/hosts.deny

Variant 1:

sshd: ALL

Variant2:

sshd,sshdfwd-X11:ALL

Which is the correct one? I am afraid to lock me out. Thanks.

1
  • 1
    Don't log out of the machine until you 100% confirm the configuration is working as intended. May 22, 2012 at 15:54

2 Answers 2

8

I would do this personally in the sshd_config using AllowUsers.

AllowUsers = *@111.111.111.111, *@222.222.222.222, *@333.333.333.333

To me, that keeps all the config in the place associated with the application you're controlling. There's always more than one way to skin a cat with UNIX, but if the tool offers a specific control mechanism I tend to prefer that over anything else (it's usually more portable).

When making changes to anything in relation to remote access,

  1. always have multiple sessions on the server already
  2. make the changes from within a screen or tmux session so you can reconnect to it if you lose connection
  3. try and make the changes from a non-ssh console if possible

I find that as long as you've got a few remote sessions already, you'll be fine. Changing /etc/ssh/sshd_config and recycling SSH does not disconnect any existing sessions.

Although I appreciate that doesn't answer your specific question. I believe Jeff's answer does (in that all those variants are valid if you use /etc/hosts.deny or /etc/hosts.allow).

2
  • I think it's better to use the options and tools that ssh gives u than using external applications such as iptables (iptables would be nice also).
    – Feiticeir0
    May 22, 2012 at 15:27
  • thanks EightBitTony. I like your solution and going to try it. I was thinking that in AllowUsers I must specify only usenames, not IPs. May 22, 2012 at 15:30
2

Generally, it is my preference to implement rules like this using iptables.

As far as the correct variant, all of those should work. The relevant man page (thanks for catching this Oliver) says using blanks or commas is acceptable. It also does go on to discuss that any match of daemon: client will count and that multiple clients can be listed to a line, and multiple entries for a daemon will all be evaluated.

1
  • 3
    List elements should be separated by blanks and/or commas.
    – Oliver
    May 22, 2012 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .