6

During set-up of a home server (running Kubuntu 10.04), I created an admin user for performing administrative tasks that may require an unmounted home. This user has a home directory on the root partition of the box.

The machine has an internet-facing SSH server, and I have restricted the set of users that can connect via SSH, but I would like to restrict it further by making admin only accessible from my laptop (or perhaps only from the local 192.168.1.0/24 range).

I currently have only an

AllowGroups ssh-users

with myself and admin as members of the ssh-users group.

What I want is something that works like you may expect this setup to work (but it doesn't):

$ groups jonathan
... ssh-users
$ groups admin
... ssh-restricted-users
$ cat /etc/ssh/sshd_config
...
AllowGroups ssh-users [email protected].*
...

Is there a way to do this? I have also tried this, but it did not work (admin could still log in remotely):

AllowUsers [email protected].* *
AllowGroups ssh-users

with admin a member of ssh-users.

I would also be fine with only allowing admin to log in with a key, and disallowing password logins, but I could find no general setting for sshd; there is a setting that requires root logins to use a key, but not for general users.

3
  • 1
    It's not a standard way of doing things, but why not you instead close of root access totally except on the local level, and give a user su powers? In short, in order to access root, user must login, then su to become root.
    – caliban
    Jan 4, 2011 at 17:12
  • @caliban I have that already. The only purpose of the admin user is to allow changes to /home without logging in as root. I use sudo for everything.
    – Jonathan
    Jan 4, 2011 at 18:43
  • Although I don't think this will apply to your particular situation, you can apply fine-grained sudo privileges - say, they can run such-and-such command, but not anything else. Jan 4, 2011 at 20:21

3 Answers 3

6

The standard pam_access.so PAM module can restrict logins by remote address, and can be applied to all services, not just ssh.

2
  • It worked. It's not perfect; instead of saying Access Denied or similar, like when you type the wrong password, it simply disconnects you, but it does prevent users in ssh-restricted-users from logging in from an outside network, and allows it from the local network. Thanks!
    – Jonathan
    Jan 4, 2011 at 20:01
  • @Jonathan: I think it could do that if you put the module to the auth section of PAM. (Do not remove it from account, however.) Jan 4, 2011 at 20:07
2

One solution would be to create an ssh key that would be restricted by the host machine to be acceptable when the connection comes from only one ip address or from a domain or subdomain:

Create the key as normal...something like:

ssh-keygen -t rsa -b 4096 -C "[email protected]"

then edit the resulting id_rsa.pub file (you have the option to choose a different base filename) which will look like this:

ssh-rsa AA.....

Edit the file to look like:

from="*.wangadingding.com" ssh-rsa AA....

Add the .pub file to the ~/.ssh/authorized_keys2 (or create it) on the target machine

Now anyone using that key (presumably "admin") can only use it from the specified domain.

1

It should be possible using the Match directive in sshd_config. To prevent admin from logging in outside your local network, something like this should work:

Match User="admin",Host="!192.168.1.0/24"
MaxAuthTries 0  # a hack — is there a better way?

To disable ssh's built-in password authentication for a user (though if I understand the documentation correctly, you can't tune PAM authentication this way, only sshd's built-in password authentication):

Match User="admin"
KbdInteractiveAuthentication No

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .