Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I would like to allow a user to login through SSH but with different permission coming from different ipaddress.

For example, a user "tester" login to SSH through 192.168.1.1 and another user login with the same login id "tester" but from different ip 192.168.1.2.

How do I restrict 192.168.1.2 to only allow for viewing the content in the home directory while giving 192.168.1.1 full access?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Approach 1 ) Based on the ip you change the shell. If it's just for read only a jail would be fine.

Approach 2 ) Use PAM to do it. http://www.cromwell-intl.com/unix/ssh-2-access-control.html The link above can give you a clue of how the whole system is working

share|improve this answer
    
Thanks for the help. I liked both of your solutions but changing shell depending upon IP how is that done can you elaborate a bit. –  Bond Jan 29 '11 at 6:41
    
A very very quick solution is to have two ssh instances. Let's say port 22 and port 24. Port 22 is for read only, while port 24 is for full access. So, if you can do the port redirection based on ip from iptables. Or you could do something similar with virtual ip addresses –  Nikolaidis Fotis Jan 29 '11 at 10:44
    
@Nikolaidis I have used and configured IPTABLES to redirect port but how do you give read only or full access using IPTABLES this is something new for me let me know. –  Bond Jan 29 '11 at 12:20
    
Ok ... As i said you have two instances of ssh. One in port 22 and one in port 24. Ok so far ? In port 22 you run an sshd with limited priviledges (read only). In port 24 you run a full access sshd. Now, what you have to do it to redirect traffic (iptables) to the proper port depending on ip. For example (192.168.1.2 goes to port 22 ) , ( 192.168.1.1 goes to port 24) –  Nikolaidis Fotis Jan 29 '11 at 12:25
    
I am not clear how do you run sshd with limited privilege I never heard any such thing.Is it some thing like chmod 655 or you are doing something like selinux sort of to achieve it. –  Bond Jan 29 '11 at 13:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.