SSH on main IP only

Splenden · 01-10-2007, 01:05 PM

I am hosting DNS servers, a Web server, and a POP3/SMTP server on my VPS. I can access SSH through all of these IPs. For security reasons, I want to only allow SSH on the main IP (which only I have - I don't use the main VPS IP for anything but SSH).

I can't seem to find a "bind IP" option in ssh_config or in the manpages for it. Does such an option exist?

Thanks!

Splenden

ilikejam · 01-10-2007, 01:17 PM

Hi.

Have a look in 'man sshd_config' for the 'ListenAddress' option.

Dave

Splenden · 01-10-2007, 01:27 PM

Thank you. I missed that.

Splenden

Splenden · 01-10-2007, 01:35 PM

I added this to ssh_config (it was not in there at all, I checked):

ListenAddress my.ip.address.here:22

However, it did not work after I did a reload (/etc/init.d/sshd reload) and then, if I try to ssh out to another location from it, I get:

/etc/ssh/ssh_config: line 3: Bad configuration option: ListenAddress
/etc/ssh/ssh_config: terminating, 1 bad configuration options

It's not a CR/LF error, I edited it in nano on that machine.

Thanks!

Splenden

anomie · 01-10-2007, 02:15 PM

ssh_config is for your client ssh software. sshd_config is for your daemon sshd software.

Are you trying to restrict to a network interface for the client or the daemon?

Splenden · 01-10-2007, 08:12 PM

Oh. I'll try sshd_config and report back.

I'm trying to restrict SSH to broadcast on one IP only, which is only known by me (that way, it can only be guessed).

Splenden

bship · 02-16-2007, 02:56 PM

We got ours working!!!
Our problem was one letter the d !
Dang!

Be sure that you edit the sshd_config and not ssh_config.
Duh!

B

live_dont_exist · 02-17-2007, 06:10 AM

You might also want to use /etc/hosts.deny on the 3 servers you're hosting on your VPS. Plus to lock down SSH even further you might want to look at this:

Code:

AllowUsers
    This keyword can be followed by a list of user name patterns, separated by spaces. If specified, login is allowed only for user names that match one of the patterns. `*' and `?' can be used as wildcards in the patterns. Only user names are valid; a numerical user ID is not recognized. By default, login is allowed for all users. If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts.

Lastly wouldnt you want to allow some kind of access to your hosted servers. Maybe SSH access only from your main VPS IP? To troubleshoot in case something goes wrong?
I've never used a VPS though, so is it that you have complete control and can change internal configs of all your other servers by merely logging on to your main VPS IP?

Cheers
Arvind