Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I restrict incoming SSH connection request to only one interface? I'm using Ubuntu Server 10.04 LST.

I want to lock down access to SSH to only one interface because I use the server as a gateway to my home network. One interface is connected to the DSL modem/router and the other is connected to the home network. I only want to allow access to SSH form inside the home network.

Is restricting SSH to one IP in this case sufficient? Or do I have to lock it down to one interface?

share|improve this question
    
Can you be more clear by what you mean by "to only one interface"? Do you mean the machine has more than one IP address and you only want SSH to listen on one IP address? Or do you mean you want inbound packets to the SSH port on other interfaces to be dropped? (Your request is very unusual and it's possible you're asking the wrong question.) –  David Schwartz Jan 9 '12 at 23:16
    
@DavidSchwartz I asked for interface restriction because I wasn't sure if it is sufficient to restrict SSH access to only one IP. I also supplemented my question with more detail. –  wowpatrick Jan 10 '12 at 10:59

2 Answers 2

up vote 5 down vote accepted

In the following file:

 /etc/ssh/sshd_config 

You'll see a line like:

#ListenAddress 0.0.0.0

This is commented out, but is the default, to list on all IP addresses for ssh requests. You can change this so that it is the IP address of the interface you want to accept connections on, and so only that IP address will accept ssh connections:

ListenAddress 111.222.111.222

Restart the sshd service once changed.

share|improve this answer
1  
This won't restrict the interfaces on which SSH can operate, only the destination IP address. (That may be what the OP really wanted. But that's not what the OP asked.) –  David Schwartz Jan 9 '12 at 23:17
    
@DavidSchwartz thanks - can you clarify? If an IP address is bound to an interface, can another interface accept a connection with this setup somehow (I suppose if forwarding was enabled it might work). –  Paul Jan 10 '12 at 0:06
    
@DavidSchwartz ah, I see your comment above. –  Paul Jan 10 '12 at 0:06
    
Forwarding only refers to a packet received on one interface that has to be transmitted by another. It's not required to accept a packet received on an interface other than the one its destination address is assigned to. Linux uses a model where IP addresses belong to the system, not to interfaces -- all interfaces connect a single host. –  David Schwartz Jan 10 '12 at 0:34

Try installing a firewall and only allow SSH on one interface. My preferences is Shorewall which is an installable package on Ubuntu. You will need to configure it before it will start, but it is well documented and comes with several example configurations.

I use a mostly closed firewall with only the ports required open. If all you want to do is limit the interface SSH is allowed on you can use a REJECT or DROP action for ssh on the other interfaces. I would suggest if you are building a firewall you at least limit access on Internet facing interfaces.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.