is there a way to restrict ssh sessions to a specific ssh client?

smbhat · 02-27-2009, 08:08 AM

Hi,

I am looking at ways in which I can restrict the SSH session requests come by specific SSH client (say Putty or NX Client). Is it possible to restrict SSH client login to a client application?

TB0ne · 02-27-2009, 09:46 AM

Quote:

Originally Posted by smbhat

Hi,

I am looking at ways in which I can restrict the SSH session requests come by specific SSH client (say Putty or NX Client). Is it possible to restrict SSH client login to a client application?

Specific client? Not that I know of. You can use the AllowUsers directive (see the sshd_config man page here http://linux.die.net/man/5/sshd_config), but there's no real way of detecting the client-type on the other end.

kentyler · 02-27-2009, 11:28 AM

The only way to do it is to use a custom compiled server and custom compiled client that you wrote specific changes to that have a server expect a specific string when the client connects, that custom client then sends the expected string. Otherwise, no it can not be done.

This is something I have done in the past and it can be done.

jschiwal · 02-28-2009, 01:21 AM

Use "AllowUsers <username>" in /etc/ssh/sshd_config.

All other users will be denied, including system users, which is very important.

smbhat · 02-28-2009, 07:01 AM

Thanks for the responses. I was thinking that there could be directive which will allow me to restrict the user to use a particular SSH client. As Ken replied, probably, I need to customize the sshd and expect a key particular to a ssh client.

Please let me know if there is a simple or better approach than this.

Thanks

anomie · 02-28-2009, 11:21 AM

You could ensure that only certain clients can authenticate by requiring pubkey authentication (and disallowing all other authentication forms).

Frankly, this is much more secure than saying "only putty users can connect" -- anyone can download putty. It's also a common practice and doesn't require you to fool around with source code (which is a pain to maintain in the long run).

smbhat · 03-01-2009, 11:10 AM

I think, I did not make my requirement very clear earlier.

I have developed a web app, which allows my users to connect to a set of Linux box. I want them to connect using the ssh (in my case its NXclient) client that gets launched from the web app using ssh keypair authentication.

However, user can save this key and connect to servers from outside of the web app. Using NX client, certain restrictions are applied for the user, which does not apply when user connects using any other ssh clients.

smbhat · 03-01-2009, 11:27 AM

can this be done using iptables? does linux firewall get to know from which client the ssh connect request originated?

kentyler · 03-11-2009, 07:36 AM

Yes you could restrict it with iptables. SSH will not know about which hosts are trying to connect but iptables will and if the ip matches the rules then it will allow connection to sshd.