Using ubuntu 12.04, I want to use sshd_config to limit ssh-sessions coming from root to a fixed subset of IP's. I want normal users to be able to ssh from anywhere, but root should only be able to ssh from an IP-range (my local subnet), as well as from one IP outside this range (my offsite backup server).
Root-access via ssh is necessary for my backup solution, so using
PermitRootLogin no
isn't a solution. At the same time, I don't want to unnecessarily endanger my systems by leaving root open for everyone and their mother.
I currently have the following in sshd_config:
AllowUsers *@*
DenyUsers root@*
AllowUsers [email protected].*
AllowUsers [email protected]
where the local subnet and offsite backup numbers are correct.
This doesn't work. Any tips on how to get this working, and why? Documentation of sshd_config hasn't helped me understand how AllowUsers and DenyUsers interact.
sudo
orsu
?ssh
which do not requireroot
login. See for example: Using rdiff-backup for remote backups