LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 02-14-2008, 12:17 AM   #1
thbaig
LQ Newbie
 
Registered: Feb 2008
Posts: 11

Rep: Reputation: 0
IP based user access


hello,
I want to configure my server in the way that from specific IP user can make connection(ssh,ftp etc).IP that are not included in the list reject to create session.
Infact I have SVN repository on this server, I want to include developer's machine IP list, so that specific IP can access to server and other may reject.
How can I do so?
 
Old 02-14-2008, 12:38 AM   #2
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682
For xinetd services, that is what /etc/hosts.deny and /etc/hosts.allow does. Some services include the tc_wrappers library on their own and have similar configuration options.

Also look at the manpage for xinetd.conf. The "only from" entry can contain a list of IP addresses.

For ssh, using "AllowUsers" is a good idea because this will also reject attempts against system accounts. The entries can have the form "user@host", which means, local-user @ remote-host. (See PATTERNS in ssh_config man page) You could simply use an IP address for the host or include these hosts in /etc/hosts if they aren't dns resolvable. I think that this would work for key-based authentication as well, because a known-hosts entry would contain the hostname or IP address.

You don't want to only use IP addresses for authentication. The users should also need to enter their username & password or passphrase.

Besides spoofing, imagine if a site has several users behind a NAT router. Each user will have the same IP address out on the internet.

Last edited by jschiwal; 02-14-2008 at 12:40 AM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
User based Authentication in Squid instead of Terminal based. TSK2000 Linux - Software 1 12-30-2005 02:22 AM
Need to access other windows based HD (HELP) veneratio Linux - Software 1 01-16-2005 12:25 PM
I lose ftp access when I disable shell access for user captainObvious Linux - General 3 11-13-2004 05:49 PM
grant user access to /fat-c & copying users' preferences to another user n0x Linux - Newbie 1 07-04-2004 12:04 AM
User based telnet access mallikarjun Linux - Networking 4 05-18-2002 03:45 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:53 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration