[SOLVED] How to limit SSH access for one account to only 2 addresses?

Woefdram · 10-24-2017, 02:56 PM

My monitoring system uses SSH to do its business. I want the managed servers to only accept this login from 2 addresses: the IPv4 and IPv6 address of my monitoring server. Seems simple, but I can't figure out how to make that work.

I've seen several threads about exactly this, such as this one, and I studied the manpage. What I think I should do, is tell SSH to deny this user if he's not coming from either of these 2 addresses.

These are the last lines in my sshd_config:

Code:

Match Address !12.23.45.78
  DenyUsers nagios
Match Address !11:22:44:55::1
  DenyUsers nagios

But it doesn't seem to do a thing, because nagios can still login from any address.

Or it could even be simpler, without any Match element:

Code:

DenyUsers nagios@!12.23.45.78 nagios@!11:22:44:55::1

Same result: nagios can login from anywhere. So I tried it the other way around: first denying access and then allowing for the 2 addresses:

Code:

DenyUsers nagios

Match Address 12.23.45.78
  AllowUsers nagios

Match Address 11:22:44:55::1
  AllowUsers nagios

But now nagios can't login from any address. Moving the top line to the bottom doesn't change it either. Whatever I try, nagios can either login from anywhere or nowhere at all.

I'm sure it's something small, but I can't figure out how to make this work.

Anyone?

Woefdram · 10-25-2017, 10:12 AM

Found it. Or better: someone else found it for me:

http://forums.debian.net/viewtopic.p...35094&#p657213

Not sure if the problem is in SSH or in my understanding of it, but if I add a * to the match list, it suddenly works as desired

Code:

Match Address !12.23.45.78,!11:22:44:55::1,*
    DenyUsers nagios

A match will not occur if not at least one of the tests is positive, that's the idea I think. Adding the wildcard does that.

Sefyir · 10-25-2017, 01:25 PM

This might be helpful as a resource
https://www.linuxquestions.org/quest...ts-4175530596/