3

Is it possible to have root shell access from one particular ip only

I am using centOS. i want that only one user can log in via shell from one ip only

Improve this question

5 Answers 5

Reset to default
8

Yes, add the following to sshd_config to enable key only login and to restrict to a particular IP address.

AllowUsers [email protected]
PermitRootLogin without-password
Improve this answer
1
  • I'm assuming the question asker doesn't know how to set up public key authentication yet so they may want "PermitRootLogin yes" instead so they can actually log in with a password.
    – Dave Forgac
    Jun 7, 2010 at 6:43
4

You could use iptables firewall rules like

iptables -I INPUT -s <IP> -p tcp -m tcp --dport 22 -j ACCEPT
iptables -I INPUT -p tcp -m tcp --dport 22 -j REJECT
Improve this answer
1

And another way to do it is with tcp wrappers through /etc/hosts.allow and /etc/hosts.deny -- see my page on this: http://wiki.xdroop.com/space/Linux/Limited+SSH+Access

Improve this answer
0

You can use the suggest line 

PermitRootLogin without-password

in sshd config. If you then prefix the line of the public key in the authorized_keys file of the root user with

from="v.x.y.z" ...

then it should have the desired effect.

See the sshd man page, it's explained in the AUTHORIZED_KEYS FILE FORMAT section.

Improve this answer
-1

See the ssh documentation:

http://www.ssh.com/support/documentation/online/ssh/adminguide/32/Restricting_User_Logins.html

Improve this answer
2
  • 1
    CentOS uses OpenSSH, the documentation link you posted is for the commercial SSH.com server. OpenSSH doesn't support all directives mentioned on that page, e. g. AllowHosts and DenyHosts.
    – joschi
    Jun 7, 2010 at 6:07
  • AllowHosts and DenyHosts can be applied via hosts.allow and hosts.deny if ssh is built with tcpwrappers.
    – BillThor
    Jun 7, 2010 at 15:56

You must log in to answer this question.