openssh AllowGroups group from specific host

Question

Is there any way to restrict ssh login from specific linux group to specific host?

I want to reach something like "AllowUsers user1@host" for linux groups.

Like: "AllowGroups group@host", but that didn't work.

That is useful because one group can login from all hosts (@host isn't specified), second group only from localhost (for web-based ssh client which forces limited shell)

I read a lot of material from internet, but I wonder that I didn't find anything to cover this problem.

Answer 1

You can do this with pam_access module, something like this:

+ : (group1) : ALL
+ : (group2) : 127.0.0.0/24
- : ALL : ALL

Activate this module by adding the following line into /etc/pam.d/sshd:

account     required pam_access.so

Also make sure that you've enabled PAM in /etc/ssh/sshd_config:

UsePAM yes