Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to have root shell access from one particular ip only

I am using centOS. i want that only one user can log in via shell from one ip only

share|improve this question

migrated from Jun 7 '10 at 2:13

This question came from our site for professional and enthusiast programmers.

Yes, add the following to sshd_config to enable key only login and to restrict to a particular IP address.

PermitRootLogin without-password
share|improve this answer
I'm assuming the question asker doesn't know how to set up public key authentication yet so they may want "PermitRootLogin yes" instead so they can actually log in with a password. – Dave Forgac Jun 7 '10 at 6:43

You could use iptables firewall rules like

iptables -I INPUT -s <IP> -p tcp -m tcp --dport 22 -j ACCEPT
iptables -I INPUT -p tcp -m tcp --dport 22 -j REJECT
share|improve this answer

And another way to do it is with tcp wrappers through /etc/hosts.allow and /etc/hosts.deny -- see my page on this:

share|improve this answer

You can use the suggest line

PermitRootLogin without-password

in sshd config. If you then prefix the line of the public key in the authorized_keys file of the root user with

from="v.x.y.z" ...

then it should have the desired effect.

See the sshd man page, it's explained in the AUTHORIZED_KEYS FILE FORMAT section.

share|improve this answer

See the ssh documentation:

share|improve this answer
CentOS uses OpenSSH, the documentation link you posted is for the commercial server. OpenSSH doesn't support all directives mentioned on that page, e. g. AllowHosts and DenyHosts. – joschi Jun 7 '10 at 6:07
AllowHosts and DenyHosts can be applied via hosts.allow and hosts.deny if ssh is built with tcpwrappers. – BillThor Jun 7 '10 at 15:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.