Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We want to limit root SSH login to only a few networks that we consider "safe" (VPN, etc.) without imposing the same condition on other accounts.

In OpenSSH 5.x, we could use the match block. However, that is not an option in OpenSSH 4.x which is what we are limited to in RHEL5.

I was thinking perhaps this could be done using PAM. Anyone have any idea?

share|improve this question
up vote 1 down vote accepted

After finding this article, I started looking into pam_access. This is the solution I am settling on:

First, I created an access file in /etc/security/sshd.conf. I chose doing this instead of using the default /etc/security/access.conf because I wanted an access file dedicated to sshd. The file looks like this:

# cat /etc/security/sshd.conf

Check out man access.conf for more information on syntax.

Then, I added the following line on top of the PAM stack in /etc/pam.d/sshd:

auth       required accessfile=/etc/security/sshd.conf

The reason I used auth instead of account as done in the article was because using account type allowed users to verify the password and then get rejected. I rather not verify the password. Check out man pam.conf for more information.

This worked perfectly.

share|improve this answer
Answering your own question is a good thing. Please consider updating it with more detail when you test this and get it working. – Zoredache Feb 15 '12 at 0:39

Yes, pam_access will do that. Other possibilities include tcp wrappers (RHEL5 sshd supports them) and iptables.

share|improve this answer
I was under the impression that tcpwrappers will not be able to distinguish user, is that incorrect? I only want this condition to apply to root account. – Belmin Fernandez Feb 14 '12 at 23:34
Didn't consider you'd need this for root-only, sorry. – Luis Bruno Feb 14 '12 at 23:38
NP, I added some text to the question to make it clear. Thank you both though! – Belmin Fernandez Feb 14 '12 at 23:43
Sorry, I failed at reading comprehension. :( – Mark Wagner Feb 14 '12 at 23:45

No experience with RHEL and friends, but I'd probably try to use tcpwrappers first -- I mean the /etc/hosts.allow and /etc/hosts.deny files:

---8<--- hosts.deny ---8<---     


---8<--- hosts.allow ---8<---
ALL: localhost, 10.y.z.

Notice the implied /24; I'm not sure about the syntax for CIDR-blocks. If you need it I can hunt it up. Try to avoid locking yourself out using these tricks.

PS: You have considered ARP spoofing, right?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.