12

How can I restrict incoming SSH connection request to only one interface? I'm using Ubuntu Server 10.04 LST.

I want to lock down access to SSH to only one interface because I use the server as a gateway to my home network. One interface is connected to the DSL modem/router and the other is connected to the home network. I only want to allow access to SSH form inside the home network.

Is restricting SSH to one IP in this case sufficient? Or do I have to lock it down to one interface?

2
  • 1
    Can you be more clear by what you mean by "to only one interface"? Do you mean the machine has more than one IP address and you only want SSH to listen on one IP address? Or do you mean you want inbound packets to the SSH port on other interfaces to be dropped? (Your request is very unusual and it's possible you're asking the wrong question.) Jan 9, 2012 at 23:16
  • @DavidSchwartz I asked for interface restriction because I wasn't sure if it is sufficient to restrict SSH access to only one IP. I also supplemented my question with more detail.
    – wowpatrick
    Jan 10, 2012 at 10:59

2 Answers 2

15

In the following file:

 /etc/ssh/sshd_config 

You'll see a line like:

#ListenAddress 0.0.0.0

This is commented out, but is the default, to list on all IP addresses for ssh requests. You can change this so that it is the IP address of the interface you want to accept connections on, and so only that IP address will accept ssh connections:

ListenAddress 111.222.111.222

Restart the sshd service once changed.

5
  • 5
    This won't restrict the interfaces on which SSH can operate, only the destination IP address. (That may be what the OP really wanted. But that's not what the OP asked.) Jan 9, 2012 at 23:17
  • @DavidSchwartz thanks - can you clarify? If an IP address is bound to an interface, can another interface accept a connection with this setup somehow (I suppose if forwarding was enabled it might work).
    – Paul
    Jan 10, 2012 at 0:06
  • @DavidSchwartz ah, I see your comment above.
    – Paul
    Jan 10, 2012 at 0:06
  • 2
    Forwarding only refers to a packet received on one interface that has to be transmitted by another. It's not required to accept a packet received on an interface other than the one its destination address is assigned to. Linux uses a model where IP addresses belong to the system, not to interfaces -- all interfaces connect a single host. Jan 10, 2012 at 0:34
  • Wow, I just learnt that the # before a line in the /etc/ssh/sshd_config actually refers to a comment. I was applying configs, but was wondering why it doesn't take any effect.
    – Jarrett
    yesterday
2

Try installing a firewall and only allow SSH on one interface. My preferences is Shorewall which is an installable package on Ubuntu. You will need to configure it before it will start, but it is well documented and comes with several example configurations.

I use a mostly closed firewall with only the ports required open. If all you want to do is limit the interface SSH is allowed on you can use a REJECT or DROP action for ssh on the other interfaces. I would suggest if you are building a firewall you at least limit access on Internet facing interfaces.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .