2

I have a server on a VPN. This server has a public address and has a gitlab instance on it. I'd like to be able to connect with any ssh user from the VPN address, but restrict the access to the git user from the public address.

How can I achieve both things at the same time?

I'm already restricting access like this:

# Listen on localhost
ListenAddress 127.0.0.1
# Listen on public address
ListenAddress 1.2.3.4
# Listen on the VPN address
ListenAddress 5.6.7.8

I'm on an Ubuntu server system, using openssh version 1:5.9p1-5ubuntu1

2 Answers 2

4

You should be able to achieve this using Match blocks ( localAddress)with additional AllowUsers/DenyUsers filtering in your sshd_config file, like this (assuming 1.2.3.4 is your public address):

Match LocalAddress 1.2.3.4
    AllowUsers git
7
  • Bah, I was half way through a convoluted answer about authorized_keys and from=. This is much better. Apr 25, 2013 at 8:53
  • I can't get this to work. Access is denied for all users with this configuration. Is there something wrong with the syntax?
    – greg0ire
    Apr 25, 2013 at 9:03
  • I tried prepending this with AllowUsers *, without success.
    – greg0ire
    Apr 25, 2013 at 9:08
  • AllowUsers * or AllowUsers git alone do what they are expected to do. Adding the Match block makes ssh deny everything for every IP.
    – greg0ire
    Apr 25, 2013 at 9:20
  • I'm using ListenAddress directives and noticed with netstat that sshd does not listen on anything as soon as I add the Match block. Is there an incompatibility?
    – greg0ire
    Apr 25, 2013 at 9:36
1

I ended up using AllowUsers, without a match block, like this:

AllowUsers git root@somepattern root@someotherpattern

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .