Suppose I have to harden a server that got compromised via a brute force attack (SSH). What command would I use to block all access to SSH and only allow connections from the IP address 1.2.3.4 to that port ?

You could use your packet filter for that. Which distro, including version, do you have? What you ask is easy but the method varies from distro to distro.

Or you could modify the SSH daemon's configuration to block everything except that one address. Then reload the configuration. See the "Match" and "MaxAuthtries" directives.

You're posting a lot of questions that don't show any details, nor any effort on your part to solve them. Putting "how to allow ssh from only one address in linux" into Google pulls up a lot of results.

Read the "Question Guidelines" link. We're happy to help with specific questions/problems, but please don't ask us to do research for you.

Sorry about that. My bad

I am using fedora 27 Workstation

Thanks. Then the filtering would be controlled by firewalld which is a little overly complex but usable.

Homework, again?
Please try to do your own work.

Forgive me.Its not home work .I am actually trying to find the answer.If I find any solution I will share it with the members.

Thanks

Ok. See post #2. Turbocapitolist already gave you the answer.

Here's another hint..Try doing a

Really? Because you were given a solution in post #2, and a search-term in post #3, and EITHER can provide you the solution. However, you are not showing any effort into putting these things into practice, but rather keep posting. Again, we aren't here to do your research for you, do your homework for you, or hand you things.

Posting something like "I found this at <link>, and have put these things in my ssh config file as so. However, things aren't working, does anyone have ideas?" is an example of a good question.

Posting "I need to do this; how do I do it?" isn't. It shows you've done/tried NOTHING, and want people to do it for you.

...and yet they keep on doing it...

1 members found this post helpful.

How about this solution :

In our sshd_config, we can add AllowUsers *@1.2.3.4
we should forbid password logins, and use keys only
we should modify the policy on the firewall that sits in front of this host so that only 1.2.3.4 is allowed in

If we use iptables, we can do something like iptables -A INPUT -p tcp -s 1.2.3.4 --dport 22 -j ACCEPT. For firewalld, there's probably already an ssh service defined we can add.
we should forbid root from logging in
we should make sure we're only using Protocol 2 in sshd_config
we can change the default port to something other than 22, although it's not going to do much other than reduce the amount of login attempts we see in our logs.

Does it make sense ?

No. Because there is zero need for IPtables to do anything mentioned above. From root access, disallow/allow access from a particular address, or change the port. ALL of those things are done within sshd_config. Your DMZ firewall rules are separate from whatever machine is running SSH (hopefully), so allowing access there needs to be done with whatever rules/software you're running on it.

for comparison:
https://help.ubuntu.com/community/SS...dvancedOpenSSH
https://help.ubuntu.com/community/StricterDefaults

All access to ssh?
Don't run openssh-server