5

I want to allow access to each user on a server through a different port. For example; user1 can only be accessed by ssh through port 2201, user 2 can only be accessed through port 2202. I have already allowed access through ports 2201 and 2202 by editing "/etc/ssh/sshd_config" and adding two lines:

Port 2201
Port 2202

Both users can now access ssh through both ports (and 22).

  • How would I restrict them to only their own ports?

(Also), the users [except root] don't have any automatically created "~/.ssh/" directory so I made one and tried adding a config file and an authorized_keys file - these don't seem to make any difference.

OS is debian squeeze and thanks in advance.

6
  • 2
    Why would you? The only solution I can think of is running multiple sshd instances... Commented Mar 14, 2011 at 18:44
  • 1
    Agreed - what's the "why" behind your question. I can't help but assume there's a better way to solve your root problem.
    – EEAA
    Commented Mar 14, 2011 at 18:58
  • 1
    Tell us why. It doesn't make any sense from a security or systems management perspective.
    – Alex Holst
    Commented Mar 14, 2011 at 21:03
  • Add a .ssh directory to /etc/skel, and then all users will get that folder automatically when their home dir is created.
    – EEAA
    Commented Mar 15, 2011 at 1:17
  • Sorry for not answering in a while, I just got out of school. Why? - I want to give each person who I allow to share my server a quota so that i dont go over my traffic limit and aquire surcharges. I want to include sftp/ scp /ssh along with other things into this quota (which I am trying to set up w/ iptables btw). Obviously I can't just put a quota on port 22 as this would be unfair if someone downloads/uploads a huge amount. Is there a better way to do this?. Thanks for all the downvotes though.
    – Nick
    Commented Mar 15, 2011 at 18:08

2 Answers 2

1

You'll have to create a separate sshd_config for each user/port combo containing (along with the usual configuration options) the ListenAddress and AllowUsers keywords.

sshd_config_2201

ListenAddress 0:2201
AllowUsers user1

sshd_config_2202

ListenAddress 0:2202
AllowUsers user2

etc.

You'll need to run sshd once for each user with the -f switch to specify the individual configuration files.

2
  • 1
    Alternatively, sshd -oPort=2201 -oAllowUsers=user1. (If you use ListenAddress 0:2201, you will be stuck with IPv4, which is ungood.) Commented Mar 15, 2011 at 6:06
  • I guess from the other comments that this probably wasn't the best solution for my problem, but until I learn systems and security management this works for me. So - thanks to both of you!
    – Nick
    Commented Mar 15, 2011 at 19:26
8

There is a solution for this. You can use two Match-conditions: One to block user2 on the first port and another one to block user 1 on the second port. Should look like this:

Match User user2, LocalPort 2201
   DenyUsers user2

Match User user1, LocalPort 2202
   DenyUsers user1

I have a similar configuration running and it works quite well (without saying that it is meaningful).

BTW: Combining Match and global Allow/Deny Rules doesn't work - at least it didn't work for me.

3
  • Please note that this is a very old question from 2011. Please try to avoid answering old questions as the answers are rarely relevant and it ends up cluttering up the home screen. Commented Feb 10, 2016 at 21:54
  • fwiw i found his answer helpful. Google found this ancient question but the new answer was the clue i needed to solve my problem.
    – Steve
    Commented Jan 6, 2017 at 6:30
  • 4
    @CatherineMacInnes Please note that answering old questions which are still valid and there is a better answer now should get a new answer. Doesn't clutter any homescreen as long as the answer is valid. And google still finds this old question and I have now a valid answer!
    – Emii Khaos
    Commented Jul 10, 2017 at 12:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .