I'd like to restrict SSH logins for a specific FreeBSD user account to a specific IP address (they're automated rsync backups from one machine to another, no actual user should ever be logging in, just the SSH+rsync process).

I feel like I should be able to do this using either hosts.allow or sshd_config... but I can't find any clear-cut example for how to do this. Can anyone tell me?


In addition to the wrappers option....I imagine this rsync backup is making use of an ssh key. You can restrict a key to a specific source IP or domain. This would be equivalent to a user-to-IP restriction since only that user is making use of that key (if your smart, which you appear).

First line of authorized_keys file:

from="trusted.domain.com",no-port-forwarding,no-pty ssh-rsa AAAABasdf

| improve this answer | |
  • Interesting! Does this only restrict access from the key, or from any SSH session in general? i.e. If someone tried to log in from another location without the key file would they be able to (if they knew the password)? If so, is there a way to restrict it so that they must have the key file to login in addition to what is described above? – Keith Palmer Jr. Mar 1 '10 at 18:33
  • Users who have no password set within /etc/shadow are automatically denied ssh login access. So if you want to require that a certain user can ONLY login using keys just remove their password. You can require all logins use keys with "PasswordAuthentication no", you can specify that only the root user must use a key with "PermitRootLogin nopwd". – CarpeNoctem Mar 2 '10 at 1:59

From the hosts.allow manpage:

       When the client host supports the RFC  931  protocol  or  one  of  its
       descendants  (TAP,  IDENT, RFC 1413) the wrapper programs can retrieve
       additional information about the owner of a connection.  Client  user-
       name  information,  when available, is logged together with the client
       host name, and can be used to match patterns like:

          daemon_list : ... user_pattern@host_pattern ...
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.