2

I have a server setup with several domains and subdomains.

I'd like to limit ssh and sftp access so a user can only connect to xxx.domain1.com but I'm not sure where this is configured.

Connecting via ay other domain/subdomain on the server should be refused.

Thanks,

J

Improve this question
1
  • Why are you trying to do this? It makes no difference in the end whatsoever.
    – Fahad Sadah
    Jun 6, 2010 at 13:03

2 Answers 2

Reset to default
8

Since SSH doesn't know something like the Host header in HTTP/1.1, you cannot deny a specific user to login to your server. The SSH daemon can't know which domain originally resolved to the IP address it is listening on.

You could only get another IP address, set it as A resource record for subdomain.example.com and allow the user only to login on that specific IP address.

Improve this answer
2

I believe you can use the hosts.allow and hosts.deny files to limit access to sshd.

Add the following line to /etc/hosts.deny:

sshd: ALL

And add the following to /etc/hosts.allow:

sshd: xxx.domain1.com

Additionally, you can use denyhosts to further protect sshd from unwanted access.

Improve this answer
2
  • 2
    Don't do this! I have lost SSH access after following this comment...
    – baptx
    Jul 25, 2014 at 17:45
  • Yeah don't do this. This permits access FROM only a single domain. What the OP wanted was to restrict connections TO a single subdomain in a 'virtualhost' manner.
    – fred2
    Jan 21, 2019 at 17:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .