4

I'd like to allow only certain hosts to connect to my server via SSH, and reject the rest with a friendly error message. Authorized users of the system will generally be non-technical, accessing this system via Filezilla.

I thought I could do this with TCP Wrappers, but when I enter the below into my hosts.deny, the client just gets the error message "ssh_exchange_identification: Connection closed by remote host"

sshd : ALL \
  : twist /bin/echo "Sorry, but your host is not allowed to connect to this server." \
  : deny

I came across a script, SSH Twist, which seemed to address this problem, but I just see the same error on the client.

For what it's worth, I'm testing on RHEL 6.1 with OpenSSH 5.3p1.

1
  • FWIW the author of that web page you link to used hosts.allow, not deny. I was able to make his script work on CentOS 5.6. Jul 12, 2011 at 20:40

2 Answers 2

4

SSH Twist looks like a bit of a hack, and I wouldn't bet on it working with all sshd versions — it makes an assumption about what it can send during session establishment that isn't necessarily true.

It's a little ugly, but you can do something like this in sshd_config:

Match Host allowedhost1
Match Host allowedhost2
# one for each host (or hostname pattern or address range) permitted
# no commands in them, just the match entries
# this just makes sure they don't fall into the following catch-all

Match Host *
    Banner /etc/ssh/refuse_msg
    DenyUsers *
1
  • This sounded great, but when I try this out sshd throws an error statging DenyUsers is not allowed inside a Match block. Perhaps this isn't possible, or just not in this release. Jul 20, 2011 at 14:45
1

In Analogy to the anwer by geekosaur, I came eventually up with the following solution: (I needed the message not for different hosts, but different users, but it should be the same principle.)

Match User *,!user1,!user2,!root
    Banner /etc/ssh/refuse_msg
    ForceCommand echo

I didn't get the ForceCommand to work with multiple "Match" lines (like in the answer by geekosaur), because it ALWAYS used the ForceCommand, maybe because there is no option "ForceCommand off".

The manual page says, that the first statement within a Match-Section "wins", but because the earlier Match-Statements didn't contain Banner or ForceCommand, the statements at the end were used. With Banner I could use "Banner /dev/null", but there's nothing that one could put in ForceCommand...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .