No need to even touch tcpwrappers...you can do the same thing within the sshd config itself.

That's just going full circle. I don't like the idea of making the change so specific. keep it generic where possible.

I don't think so. The issue is allowing certain IPs access vis SSH. It directly addressed the OP's question by allowing REGULAR user access (no root). Why even use tcpwrappers when this is pretty much built into SSHD?

What do you mean by not liking the idea of making the change so specific and keeping it generic as possible? Generic as in how (in response to my response to avijitp). Seriously, I'm not trying to be confrontational, but it almost sounds like you replied to the wrong thread.

Not bad, except it doesn't solve OP's account-sensitive requirements.

I intentionally ignored those requirements, as I think there are better alternatives than logging in as root (I stated this earlier in the thread). As to locking down the service itself and not factoring in the root account, filtering via tcpwrappers andor the SSH ACLs isn't a bad answer, IMO.

Interesting discussion about the possible reason to allow root login.

Well... there could be no really good enough reason to allow root login... maybe you are right there...

But I assure you there are good reason to look for a way to restrict root access to subnet. And it is when you start from the point where root login "must" be available.

My case for example... I'm working on a server where my boss has root login access and taking away his root access is not an option for me I assure you . In this case isn't it the best practice for a good server admin at least to enforce security by restricting the access only to the subnet my boss use???... Of course, better something than nothing fellows.

And save me the effort of explaining you why I can not try to explain my boss security risks and stuff like that... simply know that there are cases where you have to allow root access and that's all!!

So my point is... this thread ("Only permit certain IP's to login as root through ssh") is quite valid and does not indicates anything about the quality of the procedures of the admins which implements this kind of restriction... well... maybe at first glance...

1 members found this post helpful.

Regardless of your job position and the fact that your manager requires root access, its still wrong. Is your boss actually performing admin functions? Have you attempted to explain to him the dangers of using root? Have you explained to him/her that he/she can still gain root access after logging in as a normal user but that root should only be used when needed?

You're doing him/her a disservice if you're not explaining the proper way to do things. If you're afraid to do this, then the fault is yours, not the manager's. If you've done this and have been reprimanded/ignored, that's another issue...still though, this doesn't change the fact that there is only one right way regarding root access (right way = use only when needed and to leverage sudo).

Well... let's say that I did my job and tell him and I still have to let him access as root. So... Would you advise me to let root open for any network when I can restrict at least outside?. I think no.

However, the proper way to guide someone to do something like that is telling him/her the potential risks. In that way I agree with all of the security aware users in this thread.

I already explained myself...some things just need to be stated, but we seem to agree.

Thank you.