I have a server setup with several domains and subdomains.

I'd like to limit ssh and sftp access so a user can only connect to xxx.domain1.com but I'm not sure where this is configured.

Connecting via ay other domain/subdomain on the server should be refused.



  • Why are you trying to do this? It makes no difference in the end whatsoever. – Fahad Sadah Jun 6 '10 at 13:03

Since SSH doesn't know something like the Host header in HTTP/1.1, you cannot deny a specific user to login to your server. The SSH daemon can't know which domain originally resolved to the IP address it is listening on.

You could only get another IP address, set it as A resource record for subdomain.example.com and allow the user only to login on that specific IP address.


I believe you can use the hosts.allow and hosts.deny files to limit access to sshd.

Add the following line to /etc/hosts.deny:

sshd: ALL

And add the following to /etc/hosts.allow:

sshd: xxx.domain1.com

Additionally, you can use denyhosts to further protect sshd from unwanted access.

  • 1
    Don't do this! I have lost SSH access after following this comment... – baptx Jul 25 '14 at 17:45
  • Yeah don't do this. This permits access FROM only a single domain. What the OP wanted was to restrict connections TO a single subdomain in a 'virtualhost' manner. – fred2 Jan 21 '19 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.