Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to allow SSH logins only from 3 IP addresses: and and 333.333.333.333. I know, I have to edit /etc/hosts.allow and /etc/hosts.deny files.

My question is about the content of these files. I have seen different variants:

# /etc/hosts.allow

Variant 1:

sshd: 111.111.111
sshd: 222.222.222
sshd: 333.333.333

Variant 2:

sshd: 111.111.111, 222.222.222, 333.333.333

Variant 3: (without commas):

sshd: 111.111.111 222.222.222 333.333.333

Variant 4 (with sshdfwd-X11):

sshd,sshdfwd-X11: 111.111.111 222.222.222 333.333.333


Variant 1:

sshd: ALL



Which is the correct one? I am afraid to lock me out. Thanks.

share|improve this question
Don't log out of the machine until you 100% confirm the configuration is working as intended. – David Schwartz May 22 '12 at 15:54
up vote 6 down vote accepted

I would do this personally in the sshd_config using AllowUsers.

AllowUsers = *@, *@, *@333.333.333.333

To me, that keeps all the config in the place associated with the application you're controlling. There's always more than one way to skin a cat with UNIX, but if the tool offers a specific control mechanism I tend to prefer that over anything else (it's usually more portable).

When making changes to anything in relation to remote access,

  1. always have multiple sessions on the server already
  2. make the changes from within a screen or tmux session so you can reconnect to it if you lose connection
  3. try and make the changes from a non-ssh console if possible

I find that as long as you've got a few remote sessions already, you'll be fine. Changing /etc/ssh/sshd_config and recycling SSH does not disconnect any existing sessions.

Although I appreciate that doesn't answer your specific question. I believe Jeff's answer does (in that all those variants are valid if you use /etc/hosts.deny or /etc/hosts.allow).

share|improve this answer
I think it's better to use the options and tools that ssh gives u than using external applications such as iptables (iptables would be nice also). – Feiticeir0 May 22 '12 at 15:27
thanks EightBitTony. I like your solution and going to try it. I was thinking that in AllowUsers I must specify only usenames, not IPs. – user1406271 May 22 '12 at 15:30

Generally, it is my preference to implement rules like this using iptables.

As far as the correct variant, all of those should work. The relevant man page (thanks for catching this Oliver) says using blanks or commas is acceptable. It also does go on to discuss that any match of daemon: client will count and that multiple clients can be listed to a line, and multiple entries for a daemon will all be evaluated.

share|improve this answer
List elements should be separated by blanks and/or commas. – Oliver May 22 '12 at 14:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.