How to disable ssh access for user from any IP except the specified one?

Question

I need to limit the access of a user so that they can only login from a specific IP. Any attempts to log in from a different location should fail. How can I do this?

Answer 1

As I have been searching how to configure sshd for this exact same case and since using AllowUsers for this purpose would force me to list each and every other user allowed to login (and thus making a huge config file in my case), here is the way you may restrict a single user from connecting from only the hosts you want, but not affecting other users.

In sshd_config, prior to any Match block (if you had any):

DenyUsers user1@!thishostmayconnect,!anotherhostwhereitworks,*

The ! means except, so it is denying user1 except from thishostmayconnect and from anotherhostwhereitworks, but it is still missing the active denying part, and that is the wildcard * at the end.

Summing it up: denying user1 for every host except thishostmayconnect and anotherhostwhereitworks.

This way, every other user except user1 may login from wherever they please.

You may create any number of lines to restrict other users:

DenyUsers user1@!thishostmayconnect,!anotherhostwhereitworks,*
DenyUsers user2@!workstation,*

NOTE: if you have configured UseDNS no it might require to type the IP address instead of the hostname for it to work.

Additional info: http://manpages.ubuntu.com/manpages/cosmic/en/man5/sshd_config.5.html

Answer 2

Add a entry AllowUsers <user>@<ip> to your /etc/ssh/sshd_config

If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts.

From http://manpages.ubuntu.com/manpages/hardy/man5/sshd_config.5.html

This will only allow them to login from that specific ip, and thereby blocking logins from all other ip's

Answer 3

Instead of locking down the SSH server daemon configuration, you could add a firewall rule to only allow inbound SSH from a specific IP address. Based on other comments you are making, it sounds like you might want all users to only be able to login from a single specific IP address, like some kind of jump-box.

You would need an iptables rule to do this.

There is peril in this approach in that your effective configuration is split to separate executables and configuration files. Don't forget to update them both when necessary, and make sure everyone knows what all the pieces are, and what each piece does.