Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I got a Debian server with a public and a private IP in a DMZ. I need to be able to connect to it through SSH on our private side, and then block all access to the public address. Both /etc/hosts.deny and sshd_config seems to only let one block incoming IP addresses. What I really want is to disable SSH connections for the public IP. I've been trying iptables, but I haven't had luck with that neither.

Any help is appreciated.

--EDIT So to gather a list of my tries so far:

  • SSH
  • iptables iptables -I INPUT -d $public_ip -p tcp --dport 22 -j REJECT
  • /etc/hosts.deny - sshd: ALL except 192.168.2.12 $DHCPaddressrange : deny inserted.
  • Netstat - Result of netstat -tunlp | grep 22

/etc/init.d/ssh and /etc/init.d/network has been restarted so far.

Internal and external network connections have been used while trying to connect to the server. Both can access via public address.

--EDIT

IT'S ALIVE! Apparently our guest network got access, which isn't quite optimal, but I tried connecting via SSH from the phone from our guest network and without. Apparently, I can't get to it it unless I'm on one of our networks. Some firewall issue I see there though.

Thanks for your response guys.

share|improve this question
    
The public ip is configured on the system or is it behind a nat? –  Thomas Berger Oct 12 '12 at 8:59
    
What exactly did help now? –  Michuelnik Oct 12 '12 at 9:56
    
The public IP is configured on the system. I reset everything I had been working with and was going back to the SSHD config part. I entered the address it should listen on, and tried with my phone instead of my computer, to connect to it, as my phone could do it with 3G instead of our guest network. I hadn't had in thought that our guest network would cause the problem. –  VanDerSpar Oct 12 '12 at 10:39

3 Answers 3

up vote 2 down vote accepted

You can do this with iptables -I INPUT -d $public_ip -p tcp --dport 22 -j REJECT or you can bind you sshd to only listen on your private IP with ListenAddress $private_ip in /etc/ssh/sshd_config.

share|improve this answer
1  
-A will likely fail to work as it adds to the end of the INPUT chain which may already have rules that allow port 22. Much better to use -I. –  Iain Oct 11 '12 at 7:59
    
@lain: right. This should be set in the firewall initialization context anyway. –  Michuelnik Oct 11 '12 at 8:21
    
I might have some rule denying this somewhere. At least neither of the options mentioned has proved excessively useful. I do appreciate your response. –  VanDerSpar Oct 11 '12 at 8:39

If you use 2 Interfaces you can configure your ssh to only listen to one of the interfaces! In your sshd_conf you'll find a line

ListenAddress 0.0.0.0

which will bound every interface to listen to ssh!

now change it to the ip of the internal device like:

ListenAddress 192.168.0.1

restart ssh and now ssh will listen only to the internal interface!

share|improve this answer

You can do this by configuring sshd not to listen on the public address. By default sshd listens on all local addresses and you can change this with the ListenAddress directive in /etc/ssh/sshd_config

ListenAddress private.ip.add.ress

restart sshd and you should be good to go but test before you log out of the session your using to make the changes.

If you have multiple private address you want to listen on you can specify each in it's own ListenAddress directive.

share|improve this answer
    
That should work. Sadly, I does not seem to cooperate. I currently have a configuration looking like this: # Package generated configuration file # See the sshd_config(5) manpage for details # What ports, IPs and protocols we listen for Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 ListenAddress 192.168.2.12 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes –  VanDerSpar Oct 11 '12 at 8:10
    
@VanDerSpar: Did you restart you sshd ? What does netstat -tunlp | grep 22 show? I don't have a debian system to hand but this is standard stuff and works on Ubuntu and CentOS. –  Iain Oct 11 '12 at 8:34
    
I've done both a SSH restart and a network restart. The last shouldn't be necessary, but I'm ready to use most ideas. The netstat is showing this: pastebin.com/nwJubsD2 –  VanDerSpar Oct 11 '12 at 8:42
    
@VanDerSpar: That is showing that your sshd is only listening on 192.168.2.12. –  Iain Oct 11 '12 at 8:53
    
Yet, if I try to connect via my public address, I'm still allowed in. Everything seems right, but something is wrong. A picture of how this looks, with "sensitive" information removed: imgur.com/qI2E6 –  VanDerSpar Oct 11 '12 at 9:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.