Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We want to limit root SSH login to only a few networks that we consider "safe" (VPN, etc.) without imposing the same condition on other accounts.

In OpenSSH 5.x, we could use the match block. However, that is not an option in OpenSSH 4.x which is what we are limited to in RHEL5.

I was thinking perhaps this could be done using PAM. Anyone have any idea?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

After finding this Cyberciti.biz article, I started looking into pam_access. This is the solution I am settling on:

First, I created an access file in /etc/security/sshd.conf. I chose doing this instead of using the default /etc/security/access.conf because I wanted an access file dedicated to sshd. The file looks like this:

# cat /etc/security/sshd.conf
+:root:192.168.0.0/8
-:root:ALL

Check out man access.conf for more information on syntax.

Then, I added the following line on top of the PAM stack in /etc/pam.d/sshd:

auth       required     pam_access.so accessfile=/etc/security/sshd.conf

The reason I used auth instead of account as done in the Cyberciti.biz article was because using account type allowed users to verify the password and then get rejected. I rather not verify the password. Check out man pam.conf for more information.

This worked perfectly.

share|improve this answer
1  
Answering your own question is a good thing. Please consider updating it with more detail when you test this and get it working. –  Zoredache Feb 15 '12 at 0:39

Yes, pam_access will do that. Other possibilities include tcp wrappers (RHEL5 sshd supports them) and iptables.

share|improve this answer
    
I was under the impression that tcpwrappers will not be able to distinguish user, is that incorrect? I only want this condition to apply to root account. –  Belmin Fernandez Feb 14 '12 at 23:34
    
Didn't consider you'd need this for root-only, sorry. –  Luis Bruno Feb 14 '12 at 23:38
    
NP, I added some text to the question to make it clear. Thank you both though! –  Belmin Fernandez Feb 14 '12 at 23:43
    
Sorry, I failed at reading comprehension. :( –  Mark Wagner Feb 14 '12 at 23:45

No experience with RHEL and friends, but I'd probably try to use tcpwrappers first -- I mean the /etc/hosts.allow and /etc/hosts.deny files:

---8<--- hosts.deny ---8<---     
ALL: ALL

and

---8<--- hosts.allow ---8<---
ALL: localhost, 10.y.z.

Notice the implied /24; I'm not sure about the syntax for CIDR-blocks. If you need it I can hunt it up. Try to avoid locking yourself out using these tricks.

PS: You have considered ARP spoofing, right?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.