2

I'm in the process of restricting access to my Linux production box, where ssh access needs to be limited to only a few MAC addresses.

I've followed the instructions outlined in this guide and ran the following two commands:

/sbin/iptables -A INPUT -m mac --mac-source XX:XX:XX:XX:XX:XX -j DROP
/sbin/iptables -A INPUT -p tcp --destination-port 22 -m mac --mac-source XX:XX:XX:XX:XX:XX -j ACCEPT

root@xxxx:~/#: iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere            MAC XX:XX:XX:XX:XX:XX
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh MAC XX:XX:XX:XX:XX:XX

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

However I am still able to access the machine from other MAC addresses. Am I missing any steps to get this configured?

Improve this question
7
  • 1
    Why would you do it from a MAC address since they can easily be spoofed?
    – xciter
    May 24, 2011 at 14:41
  • So, are there any other best options to do it?
    – maneeshshetty
    May 24, 2011 at 15:22
  • How about IP address?
    – mrverrall
    May 24, 2011 at 15:33
  • My ipaddress are leased by DHCP server for 2 days. So if someone goes for vacation, then it will be problem for me.
    – maneeshshetty
    May 24, 2011 at 15:36
  • Can we do it wit the hostname on hosts.allow file. Any direction?
    – maneeshshetty
    May 24, 2011 at 15:36

3 Answers 3

Reset to default
1

I see the problem from your output result:

Chain INPUT (policy ACCEPT)

Your system iptables default INPUT chain rule policy is ACCEPT, it does affect your inputed MAC only. So please change its default policy to DROP.

#iptables -P INPUT DROP

Now you can test again. Your computer can be accessed through allowed MAC only.

Improve this answer
0

As commented above I think you are probably going about this the wrong way; MAC addresses can be spoofed and may even be duplicated in large networks.

If you want to limit ssh access to a few machines then restricting by IP address would be your best bet. Are these machines on a local network or global?

Note however that even blocking by IP may be a misguided approach:

  • It will restrict you if you need to access from another machine at some point.

  • ssh should be using an authentication method secure enough to keep unauthorised users out, wherever they are coming from.

My approach would be to:

  • [Definitely] Rate limit ssh connection attempts using iptables or a package like fail2ban
  • [Definitely] Only allow key based auth for shh
  • [Probably] Allow only networks that that wish to access from within iptables
Improve this answer
0

I think to do what you're asking what you actually want is ebtables.

But I think that's a bad idea (for reasons already mentioned). Better to generate ssh keys, and configure your server to only allow key based login (i.e., disable password authentication). You'll be much more secure that way.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .