Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to allow only certain hosts to connect to my server via SSH, and reject the rest with a friendly error message. Authorized users of the system will generally be non-technical, accessing this system via Filezilla.

I thought I could do this with TCP Wrappers, but when I enter the below into my hosts.deny, the client just gets the error message "ssh_exchange_identification: Connection closed by remote host"

sshd : ALL \
   : twist /bin/echo "Sorry, but your host is not allowed to connect to this server." \
   : deny

I came across a script, SSH Twist, which seemed to address this problem, but I just see the same error on the client.

For what it's worth, I'm testing on RHEL 6.1 with OpenSSH 5.3p1.

share|improve this question
    
FWIW the author of that web page you link to used hosts.allow, not deny. I was able to make his script work on CentOS 5.6. –  Nathan Powell Jul 12 '11 at 20:40

1 Answer 1

SSH Twist looks like a bit of a hack, and I wouldn't bet on it working with all sshd versions — it makes an assumption about what it can send during session establishment that isn't necessarily true.

It's a little ugly, but you can do something like this in sshd_config:

Match Host allowedhost1
Match Host allowedhost2
# one for each host (or hostname pattern or address range) permitted
# no commands in them, just the match entries
# this just makes sure they don't fall into the following catch-all

Match Host *
    Banner /etc/ssh/refuse_msg
    DenyUsers *
share|improve this answer
    
This sounded great, but when I try this out sshd throws an error statging DenyUsers is not allowed inside a Match block. Perhaps this isn't possible, or just not in this release. –  PunchMonkey Jul 20 '11 at 14:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.