2

Using ubuntu 12.04, I want to use sshd_config to limit ssh-sessions coming from root to a fixed subset of IP's. I want normal users to be able to ssh from anywhere, but root should only be able to ssh from an IP-range (my local subnet), as well as from one IP outside this range (my offsite backup server).

Root-access via ssh is necessary for my backup solution, so using

PermitRootLogin no

isn't a solution. At the same time, I don't want to unnecessarily endanger my systems by leaving root open for everyone and their mother.

I currently have the following in sshd_config:

AllowUsers *@*
DenyUsers root@*
AllowUsers [email protected].*
AllowUsers [email protected]

where the local subnet and offsite backup numbers are correct.

This doesn't work. Any tips on how to get this working, and why? Documentation of sshd_config hasn't helped me understand how AllowUsers and DenyUsers interact.

3

2 Answers 2

5

Consider simply using a SSH key to log in as root (PermitRootLogin without-password). Each key can be limited to specific source addresses using the from="1.2.3.4,8.9.0.0/24,::1" option in authorized_keys.

The manpage, right under "AllowUsers", does say:

The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

– so if a DenyUsers entry matches, any other rules will not be checked at all.

3
  • And that By default, login is allowed for all users..
    – week
    Oct 31, 2013 at 16:56
  • ssh_config patterns can be negated using ! but I have seen notes that this does not work with the allow/deny directives. Oct 31, 2013 at 17:20
  • I wasn't sure how the processing actually took place, whether a DenyUsers could overwrite an already existing AllowUsers or otherwise. But if sshd simply stops checking after it finds any match, then it's obviously not going to work the way I want. I'll look into using without-password as logon for root.
    – IceRabbit
    Oct 31, 2013 at 19:56
0

In /etc/ssh/sshd_config ensure that the following is set in the main portion of the config

PermitRootLogin no

And append this at the end of the config file. Now root can only login from local addresses.

Match Address 192.168.0.*,127.0.0.1
PermitRootLogin yes

I think this feature has been around for nearly 2 Major releases so... its surprising no one answered with this sooner.

You can do other things after the match also like enable port forwarding etc...

2
  • I've already solved it using grawity's answer. Two questions though: Does your method also work with external IPs (my off-site backup is on an external network), and is there any difference security-wise from setting PermitRootLogin without-password and explicitely restricting the authorized keys using the from="1.2.3.4" option?
    – IceRabbit
    Feb 21, 2014 at 11:04
  • You should be able to match against any IP local or remote... so you could match against the remote IPs you wish to enable PermitRootLogin without-password for... there probably isn't much difference but Match Address does solve over problems also.
    – cb88
    Feb 22, 2014 at 6:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .