7

I'd like to restrict SSH logins for a specific FreeBSD user account to a specific IP address (they're automated rsync backups from one machine to another, no actual user should ever be logging in, just the SSH+rsync process).

I feel like I should be able to do this using either hosts.allow or sshd_config... but I can't find any clear-cut example for how to do this. Can anyone tell me?

3 Answers 3

4

In addition to the wrappers option I imagine this rsync backup is making use of an ssh key.

You can restrict a key to a specific source IP or domain. This would be equivalent to a user-to-IP restriction since only that user is making use of that key (if your smart, which you appear).

First line of authorized_keys file:

from="trusted.domain.com",no-port-forwarding,no-pty ssh-rsa AAAABasdf
2
  • Interesting! Does this only restrict access from the key, or from any SSH session in general? i.e. If someone tried to log in from another location without the key file would they be able to (if they knew the password)? If so, is there a way to restrict it so that they must have the key file to login in addition to what is described above? Mar 1, 2010 at 18:33
  • Users who have no password set within /etc/shadow are automatically denied ssh login access. So if you want to require that a certain user can ONLY login using keys just remove their password. You can require all logins use keys with "PasswordAuthentication no", you can specify that only the root user must use a key with "PermitRootLogin nopwd". Mar 2, 2010 at 1:59
0

From the hosts.allow manpage:

CLIENT USERNAME LOOKUP
       When the client host supports the RFC  931  protocol  or  one  of  its
       descendants  (TAP,  IDENT, RFC 1413) the wrapper programs can retrieve
       additional information about the owner of a connection.  Client  user-
       name  information,  when available, is logged together with the client
       host name, and can be used to match patterns like:

          daemon_list : ... user_pattern@host_pattern ...
0

It is also possible to restrict the remote IP address in the sshd_config file, e.g. for root access:

PermitRootLogin no
Match Address 10.0.1.0/24
     PermitRootLogin prohibit-password

The options AllowUsers, AllowGroups, DenyUsers, DenyGroups can be used for restrictions as well, e.g.:

AllowGroups group1
Match Address 10.0.1.0/24
    AllowGroups group1 group2

The sshd_config manpage section Match has a detailed list of allowed options and description.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .