LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 10-14-2009, 11:29 AM   #16
unixfool
Member
 
Registered: May 2005
Location: Northern VA
Distribution: Slackware, Ubuntu, FreeBSD, OpenBSD, OS X
Posts: 781
Blog Entries: 8

Rep: Reputation: 157Reputation: 157

Quote:
Originally Posted by avijitp View Post
How about using the tcp wrapper. It is supported by all the distro that I am aware of. Just need to add something like this in your /etc/hosts.deny & /etc/hosts.allow

SNIP THE REST
No need to even touch tcpwrappers...you can do the same thing within the sshd config itself.
 
Old 10-14-2009, 11:45 AM   #17
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,414

Rep: Reputation: 1967Reputation: 1967Reputation: 1967Reputation: 1967Reputation: 1967Reputation: 1967Reputation: 1967Reputation: 1967Reputation: 1967Reputation: 1967Reputation: 1967
Quote:
Originally Posted by unixfool View Post
No need to even touch tcpwrappers...you can do the same thing within the sshd config itself.
That's just going full circle. I don't like the idea of making the change so specific. keep it generic where possible.
 
Old 10-14-2009, 12:31 PM   #18
unixfool
Member
 
Registered: May 2005
Location: Northern VA
Distribution: Slackware, Ubuntu, FreeBSD, OpenBSD, OS X
Posts: 781
Blog Entries: 8

Rep: Reputation: 157Reputation: 157
Quote:
Originally Posted by acid_kewpie View Post
That's just going full circle. I don't like the idea of making the change so specific. keep it generic where possible.
I don't think so. The issue is allowing certain IPs access vis SSH. It directly addressed the OP's question by allowing REGULAR user access (no root). Why even use tcpwrappers when this is pretty much built into SSHD?

What do you mean by not liking the idea of making the change so specific and keeping it generic as possible? Generic as in how (in response to my response to avijitp). Seriously, I'm not trying to be confrontational, but it almost sounds like you replied to the wrong thread.
 
Old 10-14-2009, 01:55 PM   #19
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora, Lubuntu, FreeBSD
Posts: 3,930
Blog Entries: 5

Rep: Reputation: Disabled
Quote:
Originally Posted by avijitp
How about using the tcp wrapper. It is supported by all the distro that I am aware of. Just need to add something like this in your /etc/hosts.deny & /etc/hosts.allow...
Not bad, except it doesn't solve OP's account-sensitive requirements.
 
Old 10-14-2009, 02:26 PM   #20
unixfool
Member
 
Registered: May 2005
Location: Northern VA
Distribution: Slackware, Ubuntu, FreeBSD, OpenBSD, OS X
Posts: 781
Blog Entries: 8

Rep: Reputation: 157Reputation: 157
Quote:
Originally Posted by anomie View Post
Not bad, except it doesn't solve OP's account-sensitive requirements.
I intentionally ignored those requirements, as I think there are better alternatives than logging in as root (I stated this earlier in the thread). As to locking down the service itself and not factoring in the root account, filtering via tcpwrappers andor the SSH ACLs isn't a bad answer, IMO.

 
Old 09-24-2010, 10:56 AM   #21
juan10dan
Member
 
Registered: Jun 2010
Posts: 31

Rep: Reputation: 1
Interesting discussion about the possible reason to allow root login.

Well... there could be no really good enough reason to allow root login... maybe you are right there...

But I assure you there are good reason to look for a way to restrict root access to subnet. And it is when you start from the point where root login "must" be available.

My case for example... I'm working on a server where my boss has root login access and taking away his root access is not an option for me I assure you . In this case isn't it the best practice for a good server admin at least to enforce security by restricting the access only to the subnet my boss use???... Of course, better something than nothing fellows.

And save me the effort of explaining you why I can not try to explain my boss security risks and stuff like that... simply know that there are cases where you have to allow root access and that's all!!

So my point is... this thread ("Only permit certain IP's to login as root through ssh") is quite valid and does not indicates anything about the quality of the procedures of the admins which implements this kind of restriction... well... maybe at first glance...
 
1 members found this post helpful.
Old 09-24-2010, 12:17 PM   #22
unixfool
Member
 
Registered: May 2005
Location: Northern VA
Distribution: Slackware, Ubuntu, FreeBSD, OpenBSD, OS X
Posts: 781
Blog Entries: 8

Rep: Reputation: 157Reputation: 157
Quote:
Originally Posted by juan10dan View Post
But I assure you there are good reason to look for a way to restrict root access to subnet. And it is when you start from the point where root login "must" be available.

My case for example... I'm working on a server where my boss has root login access and taking away his root access is not an option for me I assure you . In this case isn't it the best practice for a good server admin at least to enforce security by restricting the access only to the subnet my boss use???... Of course, better something than nothing fellows.

And save me the effort of explaining you why I can not try to explain my boss security risks and stuff like that... simply know that there are cases where you have to allow root access and that's all!!

So my point is... this thread ("Only permit certain IP's to login as root through ssh") is quite valid and does not indicates anything about the quality of the procedures of the admins which implements this kind of restriction... well... maybe at first glance...
Regardless of your job position and the fact that your manager requires root access, its still wrong. Is your boss actually performing admin functions? Have you attempted to explain to him the dangers of using root? Have you explained to him/her that he/she can still gain root access after logging in as a normal user but that root should only be used when needed?

You're doing him/her a disservice if you're not explaining the proper way to do things. If you're afraid to do this, then the fault is yours, not the manager's. If you've done this and have been reprimanded/ignored, that's another issue...still though, this doesn't change the fact that there is only one right way regarding root access (right way = use only when needed and to leverage sudo).
 
Old 09-27-2010, 04:09 PM   #23
juan10dan
Member
 
Registered: Jun 2010
Posts: 31

Rep: Reputation: 1
Quote:
Originally Posted by unixfool View Post
Regardless of your job position and the fact that your manager requires root access, its still wrong. Is your boss actually performing admin functions? Have you attempted to explain to him the dangers of using root? Have you explained to him/her that he/she can still gain root access after logging in as a normal user but that root should only be used when needed?

You're doing him/her a disservice if you're not explaining the proper way to do things. If you're afraid to do this, then the fault is yours, not the manager's. If you've done this and have been reprimanded/ignored, that's another issue...still though, this doesn't change the fact that there is only one right way regarding root access (right way = use only when needed and to leverage sudo).
Well... let's say that I did my job and tell him and I still have to let him access as root. So... Would you advise me to let root open for any network when I can restrict at least outside?. I think no.

However, the proper way to guide someone to do something like that is telling him/her the potential risks. In that way I agree with all of the security aware users in this thread.
 
Old 09-28-2010, 08:19 AM   #24
unixfool
Member
 
Registered: May 2005
Location: Northern VA
Distribution: Slackware, Ubuntu, FreeBSD, OpenBSD, OS X
Posts: 781
Blog Entries: 8

Rep: Reputation: 157Reputation: 157
Quote:
Originally Posted by juan10dan View Post
Well... let's say that I did my job and tell him and I still have to let him access as root. So... Would you advise me to let root open for any network when I can restrict at least outside?. I think no.
I already explained myself...some things just need to be stated, but we seem to agree.

Quote:
However, the proper way to guide someone to do something like that is telling him/her the potential risks. In that way I agree with all of the security aware users in this thread.
Thank you.
 
  


Reply

Tags
hostsallow, hostsdeny, sshdconfig, tcpwrappers


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Permit SSH From Specific IPs carlosinfl Linux - Security 3 03-18-2009 02:07 PM
Permit number of connection from same user on SSH Panagiotis_IOA Linux - Networking 5 08-03-2007 10:55 AM
How do I block IP's to prevent unauthorized SSH login attempts? leofoxx Linux - Security 6 05-23-2005 10:36 PM
kuser how to permit only network login?? rakamaka Linux - General 1 04-22-2005 12:11 AM
pppd server doesn't permit login hotrodowner Linux - Networking 10 01-28-2004 11:31 AM


All times are GMT -5. The time now is 09:49 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration