allow ssh access only from specified IP

dlugasx · 08-26-2009, 02:35 AM

Hi all,

how to create an IP TABLES rule which will accept ssh connections only from specified IP`s and rest of connection will be simple drop ?

dlugasx

win32sux · 08-26-2009, 02:46 AM

Quote:

Originally Posted by dlugasx

how to create an IP TABLES rule which will accept ssh connections only from specified IP`s and rest of connection will be simple drop ?

One way to do it (example):

Code:

iptables -N GOOD_IPS

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p TCP --dport 22 -m state --state NEW -j GOOD_IPS
iptables -A INPUT -p TCP --dport 22 -m state --state NEW -j DROP

iptables -A GOOD_IPS -s 122.45.32.56 -j ACCEPT
iptables -A GOOD_IPS -s 232.28.25.86 -j ACCEPT
iptables -A GOOD_IPS -s 45.33.86.233 -j ACCEPT
iptables -A GOOD_IPS -s 68.47.132.24 -j ACCEPT

dlugasx · 08-26-2009, 02:51 AM

Quote:

Originally Posted by win32sux

One way to do it (example):

Code:

iptables -N GOOD_IPS

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p TCP --dport 22 -m state --state NEW -j GOOD_IPS
iptables -A INPUT -p TCP --dport 22 -m state --state NEW -j DROP

iptables -A GOOD_IPS -s 122.45.32.56 -j ACCEPT
iptables -A GOOD_IPS -s 232.28.25.86 -j ACCEPT
iptables -A GOOD_IPS -s 45.33.86.233 -j ACCEPT
iptables -A GOOD_IPS -s 68.47.132.24 -j ACCEPT

Quote:

iptables -N GOOD_IPS

I dont understand this. What is mean GOOD_IPS ? Should I put some IP`s in this line instead of GOOD_IPS ?

colucix · 08-26-2009, 02:55 AM

Quote:

Originally Posted by dlugasx

I dont understand this. What is mean GOOD_IPS ? Should I put some IP`s in this line instead of GOOD_IPS ?

Nope. GOOD_IPS in this example is a user-defined chain. You add the good IPs with the last 4 statements. Take in mind that the -j (jump) option of iptables can accept a target like DROP, ACCEPT and so on OR the name of a chain to jump to.

JulianTosh · 08-28-2009, 04:08 AM

Also, host.allow and host.deny are simple tools to accomplish this.

kdelover · 08-28-2009, 11:07 AM

to accept from one and deny to all write 2 rules first write the deny statement followed by an allow statement using the -I option not -A.

iptables -t filter -I INPUT -p tcp -s <SN> -d <DIP> --dport 22 -j DROP
iptables -t filter -I INPUT -p tcp -s <SIP> -d <DIP> --dport 22 -j ACCEPT

win32sux · 08-28-2009, 11:24 AM

Quote:

Originally Posted by kdelover

to accept from one and deny to all write 2 rules first write the deny statement followed by an allow statement using the -I option not -A.

iptables -t filter -I INPUT -p tcp -s <SN> -d <DIP> --dport 22 -j DROP
iptables -t filter -I INPUT -p tcp -s <SIP> -d <DIP> --dport 22 -j ACCEPT

True, but he did make it sound like he actually wanted to allow more than one IP.

kdelover · 08-28-2009, 12:55 PM

Quote:

Originally Posted by win32sux

True, but he did make it sound like he actually wanted to allow more than one IP.

Yeah true in that case he can include a deny statement to all first,then followed by allow statements to those who are to be alloed ,so his iptables should look something like

Allow A
Allow B
Allow C
Deny ALL

Or may be create a custom chain with implict deny all policy with the exceptions he wants to include.

Or if not iptables try tcpwrappers that should be an easier thing to do.

win32sux · 08-28-2009, 01:47 PM

Quote:

Originally Posted by kdelover

Yeah true in that case he can include a deny statement to all first,then followed by allow statements to those who are to be alloed ,so his iptables should look something like

Allow A
Allow B
Allow C
Deny ALL

Or may be create a custom chain with implict deny all policy with the exceptions he wants to include.

Ummm, yeah, that's pretty much what I did in post #2.

kdelover · 08-28-2009, 01:59 PM

^^^ oh,yeah

i didnt go through all the posts.

JulianTosh · 08-28-2009, 04:53 PM

Quote:

Originally Posted by Admiral Beotch

Also, host.allow and host.deny are simple tools to accomplish this.

To make this work in hosts.allow|deny...

In /etc/hosts.allow:

Code:

sshd: 127.0.0.1 122.45.32.56 232.28.25.86 45.33.86.233 68.47.132.24

In /etc/hosts.deny:

Code:

sshd: ALL

jschiwal · 08-28-2009, 11:13 PM

Also look at AllowUsers which can be of the form user@hostname.com.
You can also add a "from=" optional field to the beginning of an authorized keys file. This allows more controls on a per-user bases such as
nopty. See the sshd manpage for more details.

saifkhan123 · 08-31-2009, 01:29 AM

you can use /etc/sshd_config file effectively for that purpose also, if you are using openssh 5.x version(i dont know if earlier versions support the below lines) than you can use this line in the file

Code:

AllowUsers user1@ip-address user2@ip-address user3......

also you can use

Code:

DenyUsers user@ip-address