Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a home server with some SSH accounts that have weak passwords. Since we only used it locally, that's not that big a problem.

Now I want to allow external access from only one account, but still local access from the others. But this doesn't work (because only a subset of options is allowed in matches):

AllowUsers externaluser
Match Address 192.168.0.0/24
AllowGroups localusers

What's the best way to emulate this? (or should I just allow the local users external access, too, but without password auth, hoping they keep their private keys private?)

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Maybe pam_access would be a better way to do this?

eg: in /etc/security/access.conf, do lines like:

    + : root : 192.168.0.
    + : localonlygroup : 192.168.0.
    + : remoteuser: ALL
    - : ALL : ALL

Then make sure /etc/pam.d/sshd, around where there's probably a line like:

    account    required     pam_nologin.so

add another line like:

    account    required     pam_access.so
share|improve this answer
    
sorry for taking so long to accept, works nicely and I don't have to touch IPtables. I've added + : ALL : tty1 tty2 tty3 tty4 tty5 tty6 to the start though, to have a fallback, since there are examples for X and TTY, so I'm guessing it's always consulted… –  pascal Jan 28 '12 at 3:52

It is possible to achieve exactly what you are trying!

One solution is to run two different sshd instances, one for external facing users and one for internal users. With some clever use of the iptables REDIRECT target, you can continue to allow people to connect to sshd on port 22, but depending on where they're coming from they'll get the appropriate instance. Something like:

# Connect inside users to "inside" sshd.
iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 22 -j REDIRECT --to-ports 2200

# Connect out*emphasized text*side users to "outside" sshd.
iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 22 -j REDIRECT --to-ports 2201

This presumes you have the inside sshd listening on port 2200 and the outside sshd listening on port 2201, and that each one is using an appropriately configured sshd_config file. Note also that for this to work you'll need:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 2200 -j ACCEPT
iptables -A INPUT -p tcp --dport 2201 -j ACCEPT

We do exactly this for some of our interactive login hosts and it works nicely.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.