Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

During set-up of a home server (running Kubuntu 10.04), I created an admin user for performing administrative tasks that may require an unmounted home. This user has a home directory on the root partition of the box.

The machine has an internet-facing SSH server, and I have restricted the set of users that can connect via SSH, but I would like to restrict it further by making admin only accessible from my laptop (or perhaps only from the local 192.168.1.0/24 range).

I currently have only an

AllowGroups ssh-users

with myself and admin as members of the ssh-users group.

What I want is something that works like you may expect this setup to work (but it doesn't):

$ groups jonathan
... ssh-users
$ groups admin
... ssh-restricted-users
$ cat /etc/ssh/sshd_config
...
AllowGroups ssh-users ssh-restricted-users@192.168.1.*
...

Is there a way to do this? I have also tried this, but it did not work (admin could still log in remotely):

AllowUsers admin@192.168.1.* *
AllowGroups ssh-users

with admin a member of ssh-users.

I would also be fine with only allowing admin to log in with a key, and disallowing password logins, but I could find no general setting for sshd; there is a setting that requires root logins to use a key, but not for general users.

share|improve this question

3 Answers 3

up vote 5 down vote accepted

The standard pam_access.so PAM module can restrict logins by remote address, and can be applied to all services, not just ssh.

share|improve this answer

It should be possible using the Match directive in sshd_config. To prevent admin from logging in outside your local network, something like this should work:

Match User="admin",Host="!192.168.1.0/24"
MaxAuthTries 0  # a hack — is there a better way?

To disable ssh's built-in password authentication for a user (though if I understand the documentation correctly, you can't tune PAM authentication this way, only sshd's built-in password authentication):

Match User="admin"
KbdInteractiveAuthentication No
share|improve this answer

One solution would be to create an ssh key that would be restricted by the host machine to be acceptable when the connection comes from only one ip address or from a domain or subdomain:

Create the key as normal...something like:

ssh-keygen -t rsa -b 4096 -C "admin@wangadingding.com"

then edit the resulting id_rsa.pub file (you have the option to choose a different base filename) which will look like this:

ssh-rsa AA.....

Edit the file to look like:

from="*.wangadingding.com" ssh-rsa AA....

Add the .pub file to the ~/.ssh/authorized_keys2 (or create it) on the target machine

Now anyone using that key (presumably "admin") can only use it from the specified domain.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com?utm_source=stackoverflow.com&amp;utm_medium=site-ui&amp;utm_campaign=footerlink\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a>                   with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.10.25.1965\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Super User works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </noscri"], "copyright__copyright__copyright": [" like this:\n\nssh-rsa AA.....\n\nEdit the file to look like:\n\nfrom=\"*.wangadingding.com\" ssh-rsa AA....\n\nAdd the .pub file to the ~/.ssh/authorized_keys2 (or create it) on the target machine\n\nNow anyone using that key (presumably \"admin\") can only use it from the specified domain.\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}