1

I want to use WHM/Cpanel's Host Access Control interface to change some settings in hosts.allow and hosts.deny. I want to block all access to our SSH exept from the IP we have from our office.

Daemon  Access List             Action      Comment
sshd      ALL EXCEPT x.x.x.x        deny          Deny access from all other IPs apart from ours

But I am worried about what happens if our IP changes, which it does about twice a week. How would I get back in to edit the hosts.allow / hosts.deny files?

3 Answers 3

2
  1. subscribe to a free dynamic DNS (plenty of) for your office ip.
  2. make sure to update that dynamic DNS on a regular basis.
  3. in hosts.deny add: sshd: ALL
  4. in hosts.allow add: sshd: /path/to/allowed_ip.file
  5. on your host's crontab: */30 * * * * host your_office_ddns_domain | awk '{print $4}' > /path/to/allowed_ip.file
  6. you are done.

Warning: while playing around with the tcpd wrapper of your distant host, make sure to keep a live ssh session open all the time as a new connection will not be possible if you make something wrong.

1

You wouldn't. So don't restrict access to your server by IP if you don't have a static IP to restrict access to. If you disable password SSH access, and only allow access via public keys, you can open up SSH access to the world with no practical risk of compromise. Far more dangerous is the WHM web control panel, which is a swiss cheese of vulnerabilities and can't be easily secured -- that is where you would want to focus your security attentions on.

1
  • So how would I go about restricting access to the WHM control panel?
    – beingalex
    Jul 6, 2012 at 15:38
1

Update: Drop the answer below please. In the ssh protocol the client doesn't provide a hostname, so tcp_wrappers would likely base itself on the client's IP address reverse name, which you obviously don't control.

Overall, to be bluntly honest you just shouldn't use IP-based security for ssh. You can't expect IP addresses to properly identify anyone on the Internet.

You should use RSA key pairs, which provide strong security, and disable password-based authentication.

If you really really want an extra layer of security, go a bit further: add a VPN or two-factor authentication (eg Yubikey, not that I have any interest in their business).


I might state the obvious: use a hostname instead of an IP in /etc/hosts.{allow,deny}.

Then you can use any DNS provider offering a low TTL if the IP changes often.

But if name resolution breaks, you're stuck! So I'd highly recommend also allowing a "jump host": a machine with a static IP address which you have access to. A friend's server could do if your resources are limited.

You'll find more about the possibilities of those files in hosts_access(5).

Note that Arch Linux considers the hosts.{allow,deny} technology (tcp_wrappers) dead (announcement). That doesn't mean it will go anywhere any time soon in more mainstream distributions, but the future doesn't look bright either.

1
  • Obvious but I could never get the tcp wrapper resolve on ddns names (debian). It would otherwise be the simplest solution.
    – ripat
    Jul 6, 2012 at 12:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .