Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to have root shell access from one particular ip only

I am using centOS. i want that only one user can log in via shell from one ip only

share|improve this question

migrated from stackoverflow.com Jun 7 '10 at 2:13

This question came from our site for professional and enthusiast programmers.

add comment

5 Answers 5

Yes, add the following to sshd_config to enable key only login and to restrict to a particular IP address.

AllowUsers root@ip.add.re.ss
PermitRootLogin without-password
share|improve this answer
    
I'm assuming the question asker doesn't know how to set up public key authentication yet so they may want "PermitRootLogin yes" instead so they can actually log in with a password. –  Dave Forgac Jun 7 '10 at 6:43
add comment

You could use iptables firewall rules like

iptables -I INPUT -s <IP> -p tcp -m tcp --dport 22 -j ACCEPT
iptables -I INPUT -p tcp -m tcp --dport 22 -j REJECT
share|improve this answer
add comment

And another way to do it is with tcp wrappers through /etc/hosts.allow and /etc/hosts.deny -- see my page on this: http://wiki.xdroop.com/space/Linux/Limited+SSH+Access

share|improve this answer
add comment

See the ssh documentation:

http://www.ssh.com/support/documentation/online/ssh/adminguide/32/Restricting_User_Logins.html

share|improve this answer
1  
CentOS uses OpenSSH, the documentation link you posted is for the commercial SSH.com server. OpenSSH doesn't support all directives mentioned on that page, e. g. AllowHosts and DenyHosts. –  joschi Jun 7 '10 at 6:07
    
AllowHosts and DenyHosts can be applied via hosts.allow and hosts.deny if ssh is built with tcpwrappers. –  BillThor Jun 7 '10 at 15:56
add comment

You can use the suggest line

PermitRootLogin without-password

in sshd config. If you then prefix the line of the public key in the authorized_keys file of the root user with

from="v.x.y.z" ...

then it should have the desired effect.

See the sshd man page, it's explained in the AUTHORIZED_KEYS FILE FORMAT section.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.