Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to restrict SSH logins for a specific FreeBSD user account to a specific IP address (they're automated rsync backups from one machine to another, no actual user should ever be logging in, just the SSH+rsync process).

I feel like I should be able to do this using either hosts.allow or sshd_config... but I can't find any clear-cut example for how to do this. Can anyone tell me?

share|improve this question
add comment

2 Answers

In addition to the wrappers option....I imagine this rsync backup is making use of an ssh key. You can restrict a key to a specific source IP or domain. This would be equivalent to a user-to-IP restriction since only that user is making use of that key (if your smart, which you appear).

First line of authorized_keys file:

from="trusted.domain.com",no-port-forwarding,no-pty ssh-rsa AAAABasdf

share|improve this answer
    
Interesting! Does this only restrict access from the key, or from any SSH session in general? i.e. If someone tried to log in from another location without the key file would they be able to (if they knew the password)? If so, is there a way to restrict it so that they must have the key file to login in addition to what is described above? –  Keith Palmer Mar 1 '10 at 18:33
    
Users who have no password set within /etc/shadow are automatically denied ssh login access. So if you want to require that a certain user can ONLY login using keys just remove their password. You can require all logins use keys with "PasswordAuthentication no", you can specify that only the root user must use a key with "PermitRootLogin nopwd". –  CarpeNoctem Mar 2 '10 at 1:59
add comment

From the hosts.allow manpage:

CLIENT USERNAME LOOKUP
       When the client host supports the RFC  931  protocol  or  one  of  its
       descendants  (TAP,  IDENT, RFC 1413) the wrapper programs can retrieve
       additional information about the owner of a connection.  Client  user-
       name  information,  when available, is logged together with the client
       host name, and can be used to match patterns like:

          daemon_list : ... user_pattern@host_pattern ...
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.