2

I would like to allow a user to login through SSH but with different permission coming from different ipaddress.

For example, a user "tester" login to SSH through 192.168.1.1 and another user login with the same login id "tester" but from different ip 192.168.1.2.

How do I restrict 192.168.1.2 to only allow for viewing the content in the home directory while giving 192.168.1.1 full access?

1 Answer 1

3

Approach 1 ) Based on the ip you change the shell. If it's just for read only a jail would be fine.

Approach 2 ) Use PAM to do it. http://www.cromwell-intl.com/unix/ssh-2-access-control.html The link above can give you a clue of how the whole system is working

6
  • Thanks for the help. I liked both of your solutions but changing shell depending upon IP how is that done can you elaborate a bit.
    – Bond
    Jan 29, 2011 at 6:41
  • A very very quick solution is to have two ssh instances. Let's say port 22 and port 24. Port 22 is for read only, while port 24 is for full access. So, if you can do the port redirection based on ip from iptables. Or you could do something similar with virtual ip addresses Jan 29, 2011 at 10:44
  • @Nikolaidis I have used and configured IPTABLES to redirect port but how do you give read only or full access using IPTABLES this is something new for me let me know.
    – Bond
    Jan 29, 2011 at 12:20
  • Ok ... As i said you have two instances of ssh. One in port 22 and one in port 24. Ok so far ? In port 22 you run an sshd with limited priviledges (read only). In port 24 you run a full access sshd. Now, what you have to do it to redirect traffic (iptables) to the proper port depending on ip. For example (192.168.1.2 goes to port 22 ) , ( 192.168.1.1 goes to port 24) Jan 29, 2011 at 12:25
  • I am not clear how do you run sshd with limited privilege I never heard any such thing.Is it some thing like chmod 655 or you are doing something like selinux sort of to achieve it.
    – Bond
    Jan 29, 2011 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.