Update: Drop the answer below please. In the ssh
protocol the client doesn't provide a hostname, so tcp_wrappers
would likely base itself on the client's IP address reverse name, which you obviously don't control.
Overall, to be bluntly honest you just shouldn't use IP-based security for ssh
. You can't expect IP addresses to properly identify anyone on the Internet.
You should use RSA key pairs, which provide strong security, and disable password-based authentication.
If you really really want an extra layer of security, go a bit further: add a VPN or two-factor authentication (eg Yubikey, not that I have any interest in their business).
I might state the obvious: use a hostname instead of an IP in /etc/hosts.{allow,deny}
.
Then you can use any DNS provider offering a low TTL if the IP changes often.
But if name resolution breaks, you're stuck! So I'd highly recommend also allowing a "jump host": a machine with a static IP address which you have access to. A friend's server could do if your resources are limited.
You'll find more about the possibilities of those files in hosts_access(5)
.
Note that Arch Linux considers the hosts.{allow,deny}
technology (tcp_wrappers
) dead (announcement). That doesn't mean it will go anywhere any time soon in more mainstream distributions, but the future doesn't look bright either.