Only permit certain IP's to login as root through ssh
Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
How about using the tcp wrapper. It is supported by all the distro that I am aware of. Just need to add something like this in your /etc/hosts.deny & /etc/hosts.allow
SNIP THE REST
No need to even touch tcpwrappers...you can do the same thing within the sshd config itself.
That's just going full circle. I don't like the idea of making the change so specific. keep it generic where possible.
I don't think so. The issue is allowing certain IPs access vis SSH. It directly addressed the OP's question by allowing REGULAR user access (no root). Why even use tcpwrappers when this is pretty much built into SSHD?
What do you mean by not liking the idea of making the change so specific and keeping it generic as possible? Generic as in how (in response to my response to avijitp). Seriously, I'm not trying to be confrontational, but it almost sounds like you replied to the wrong thread.
How about using the tcp wrapper. It is supported by all the distro that I am aware of. Just need to add something like this in your /etc/hosts.deny & /etc/hosts.allow...
I intentionally ignored those requirements, as I think there are better alternatives than logging in as root (I stated this earlier in the thread). As to locking down the service itself and not factoring in the root account, filtering via tcpwrappers andor the SSH ACLs isn't a bad answer, IMO.
Interesting discussion about the possible reason to allow root login.
Well... there could be no really good enough reason to allow root login... maybe you are right there...
But I assure you there are good reason to look for a way to restrict root access to subnet. And it is when you start from the point where root login "must" be available.
My case for example... I'm working on a server where my boss has root login access and taking away his root access is not an option for me I assure you . In this case isn't it the best practice for a good server admin at least to enforce security by restricting the access only to the subnet my boss use???... Of course, better something than nothing fellows.
And save me the effort of explaining you why I can not try to explain my boss security risks and stuff like that... simply know that there are cases where you have to allow root access and that's all!!
So my point is... this thread ("Only permit certain IP's to login as root through ssh") is quite valid and does not indicates anything about the quality of the procedures of the admins which implements this kind of restriction... well... maybe at first glance...
But I assure you there are good reason to look for a way to restrict root access to subnet. And it is when you start from the point where root login "must" be available.
My case for example... I'm working on a server where my boss has root login access and taking away his root access is not an option for me I assure you . In this case isn't it the best practice for a good server admin at least to enforce security by restricting the access only to the subnet my boss use???... Of course, better something than nothing fellows.
And save me the effort of explaining you why I can not try to explain my boss security risks and stuff like that... simply know that there are cases where you have to allow root access and that's all!!
So my point is... this thread ("Only permit certain IP's to login as root through ssh") is quite valid and does not indicates anything about the quality of the procedures of the admins which implements this kind of restriction... well... maybe at first glance...
Regardless of your job position and the fact that your manager requires root access, its still wrong. Is your boss actually performing admin functions? Have you attempted to explain to him the dangers of using root? Have you explained to him/her that he/she can still gain root access after logging in as a normal user but that root should only be used when needed?
You're doing him/her a disservice if you're not explaining the proper way to do things. If you're afraid to do this, then the fault is yours, not the manager's. If you've done this and have been reprimanded/ignored, that's another issue...still though, this doesn't change the fact that there is only one right way regarding root access (right way = use only when needed and to leverage sudo).
Regardless of your job position and the fact that your manager requires root access, its still wrong. Is your boss actually performing admin functions? Have you attempted to explain to him the dangers of using root? Have you explained to him/her that he/she can still gain root access after logging in as a normal user but that root should only be used when needed?
You're doing him/her a disservice if you're not explaining the proper way to do things. If you're afraid to do this, then the fault is yours, not the manager's. If you've done this and have been reprimanded/ignored, that's another issue...still though, this doesn't change the fact that there is only one right way regarding root access (right way = use only when needed and to leverage sudo).
Well... let's say that I did my job and tell him and I still have to let him access as root. So... Would you advise me to let root open for any network when I can restrict at least outside?. I think no.
However, the proper way to guide someone to do something like that is telling him/her the potential risks. In that way I agree with all of the security aware users in this thread.
Well... let's say that I did my job and tell him and I still have to let him access as root. So... Would you advise me to let root open for any network when I can restrict at least outside?. I think no.
I already explained myself...some things just need to be stated, but we seem to agree.
Quote:
However, the proper way to guide someone to do something like that is telling him/her the potential risks. In that way I agree with all of the security aware users in this thread.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.