Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to allow only certain hosts to connect to my server via SSH, and reject the rest with a friendly error message. Authorized users of the system will generally be non-technical, accessing this system via Filezilla.

I thought I could do this with TCP Wrappers, but when I enter the below into my hosts.deny, the client just gets the error message "ssh_exchange_identification: Connection closed by remote host"

sshd : ALL \
   : twist /bin/echo "Sorry, but your host is not allowed to connect to this server." \
   : deny

I came across a script, SSH Twist, which seemed to address this problem, but I just see the same error on the client.

For what it's worth, I'm testing on RHEL 6.1 with OpenSSH 5.3p1.

share|improve this question
FWIW the author of that web page you link to used hosts.allow, not deny. I was able to make his script work on CentOS 5.6. – Nathan Powell Jul 12 '11 at 20:40

SSH Twist looks like a bit of a hack, and I wouldn't bet on it working with all sshd versions — it makes an assumption about what it can send during session establishment that isn't necessarily true.

It's a little ugly, but you can do something like this in sshd_config:

Match Host allowedhost1
Match Host allowedhost2
# one for each host (or hostname pattern or address range) permitted
# no commands in them, just the match entries
# this just makes sure they don't fall into the following catch-all

Match Host *
    Banner /etc/ssh/refuse_msg
    DenyUsers *
share|improve this answer
This sounded great, but when I try this out sshd throws an error statging DenyUsers is not allowed inside a Match block. Perhaps this isn't possible, or just not in this release. – PunchMonkey Jul 20 '11 at 14:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.