5

I got a Debian server with a public and a private IP in a DMZ. I need to be able to connect to it through SSH on our private side, and then block all access to the public address. Both /etc/hosts.deny and sshd_config seems to only let one block incoming IP addresses. What I really want is to disable SSH connections for the public IP. I've been trying iptables, but I haven't had luck with that neither.

Any help is appreciated.

--EDIT So to gather a list of my tries so far:

  • SSH
  • iptables iptables -I INPUT -d $public_ip -p tcp --dport 22 -j REJECT
  • /etc/hosts.deny - sshd: ALL except 192.168.2.12 $DHCPaddressrange : deny inserted.
  • Netstat - Result of netstat -tunlp | grep 22

/etc/init.d/ssh and /etc/init.d/network has been restarted so far.

Internal and external network connections have been used while trying to connect to the server. Both can access via public address.

--EDIT

IT'S ALIVE! Apparently our guest network got access, which isn't quite optimal, but I tried connecting via SSH from the phone from our guest network and without. Apparently, I can't get to it it unless I'm on one of our networks. Some firewall issue I see there though.

Thanks for your response guys.

Improve this question
3
  • The public ip is configured on the system or is it behind a nat?
    – Thomas Berger
    Oct 12, 2012 at 8:59
  • What exactly did help now?
    – Michuelnik
    Oct 12, 2012 at 9:56
  • The public IP is configured on the system. I reset everything I had been working with and was going back to the SSHD config part. I entered the address it should listen on, and tried with my phone instead of my computer, to connect to it, as my phone could do it with 3G instead of our guest network. I hadn't had in thought that our guest network would cause the problem.
    – VanDerSpar
    Oct 12, 2012 at 10:39

3 Answers 3

Reset to default
2

You can do this with iptables -I INPUT -d $public_ip -p tcp --dport 22 -j REJECT or you can bind you sshd to only listen on your private IP with ListenAddress $private_ip in /etc/ssh/sshd_config.

Improve this answer
3
  • 1
    -A will likely fail to work as it adds to the end of the INPUT chain which may already have rules that allow port 22. Much better to use -I.
    – user9517
    Oct 11, 2012 at 7:59
  • @lain: right. This should be set in the firewall initialization context anyway.
    – Michuelnik
    Oct 11, 2012 at 8:21
  • I might have some rule denying this somewhere. At least neither of the options mentioned has proved excessively useful. I do appreciate your response.
    – VanDerSpar
    Oct 11, 2012 at 8:39
0

You can do this by configuring sshd not to listen on the public address. By default sshd listens on all local addresses and you can change this with the ListenAddress directive in /etc/ssh/sshd_config

ListenAddress private.ip.add.ress

restart sshd and you should be good to go but test before you log out of the session your using to make the changes.

If you have multiple private address you want to listen on you can specify each in it's own ListenAddress directive.

Improve this answer
7
  • That should work. Sadly, I does not seem to cooperate. I currently have a configuration looking like this: # Package generated configuration file # See the sshd_config(5) manpage for details # What ports, IPs and protocols we listen for Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 ListenAddress 192.168.2.12 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes
    – VanDerSpar
    Oct 11, 2012 at 8:10
  • @VanDerSpar: Did you restart you sshd ? What does netstat -tunlp | grep 22 show? I don't have a debian system to hand but this is standard stuff and works on Ubuntu and CentOS.
    – user9517
    Oct 11, 2012 at 8:34
  • I've done both a SSH restart and a network restart. The last shouldn't be necessary, but I'm ready to use most ideas. The netstat is showing this: pastebin.com/nwJubsD2
    – VanDerSpar
    Oct 11, 2012 at 8:42
  • @VanDerSpar: That is showing that your sshd is only listening on 192.168.2.12.
    – user9517
    Oct 11, 2012 at 8:53
  • Yet, if I try to connect via my public address, I'm still allowed in. Everything seems right, but something is wrong. A picture of how this looks, with "sensitive" information removed: imgur.com/qI2E6
    – VanDerSpar
    Oct 11, 2012 at 9:07
0

If you use 2 Interfaces you can configure your ssh to only listen to one of the interfaces! In your sshd_conf you'll find a line

ListenAddress 0.0.0.0

which will bound every interface to listen to ssh!

now change it to the ip of the internal device like: 

ListenAddress 192.168.0.1

restart ssh and now ssh will listen only to the internal interface!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .