I have an Ubuntu server machine that hosts Redmine and git repositories in a DMZ. The only users who have an SSH access are the administrators. Users from outside need to have access to Git and the web interface of Redmine, but I would like that SSH access is restricted to connections from inside the network (we have a VPN set up, so even from outside I would be able to SSH in the server through it).

How can I prevent SSH access from outside the LAN, still allowing Git access?

Thanks a lot in advance!


  • Just a side question, why is it in a DMZ? Why not just forward the ports that are used by the server and block the rest? – IQAndreas Aug 7 '15 at 7:17
  • It's the setup they chose for school where I work. All the internal servers are split into those that are visible from outside (and therefore are put in the DMZ) and those which are "internal only". – RH6 Aug 7 '15 at 7:27

OpenSSH (which I'm assuming is what you are using) has an AllowUsers option:

AllowUsers - This keyword can be followed by a list of user name patterns, separated by spaces. If specified, login is allowed only for user names that match one of the patterns. Only user names are valid; a numerical user ID is not recognized. By default, login is allowed for all users. If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

Edit the file /etc/ssh/sshd_config file, and add this to the bottom of it:

AllowUsers git adam@192.168.0.* bob@192.168.0.* cliff@192.168.0.* david@192.168.0.*

If that doesn't work (and this way might actually be cleaner) you can use the Match option together with AllowUsers:

# This is the default setting (only allow GIT access)
AllowUsers git 

# This is the setting that is ONLY available if you are SSHing from the LAN (allow the listed users)
Match Address 192.168.0.*
    AllowUsers git adam bob cliff dave
  • That should theoretically be possible, though I can't test it on the current machine. Try that code, and let me know if you have any problems. – IQAndreas Aug 7 '15 at 7:28
  • Fantastic, that's exactly what I was looking for (and couldn't find googling), I'll test it right now, thanks a lot!!! – RH6 Aug 7 '15 at 7:32
  • @RH6 I added a second option which is a bit easier to read and change. You can try and see if that works as well. – IQAndreas Aug 7 '15 at 7:41
  • @RH6 Really, my untested code actually worked? Did you test both the blocking and accepting? And remember to restart the server (sudo service ssh restart) after making the changes? If so, wonderful! :) – IQAndreas Aug 7 '15 at 7:43
  • Haven't tested the second option yet, I am going to do it now. The first one works, I've tried with a few virtual machines trying to log in with allowed/blocked access and it does exactly what you said. :) – RH6 Aug 7 '15 at 7:50

you can use your systems iptables. This three lines would do the magic

# iptables -A INPUT -p tcp --dport 22 -s -j ACCEPT
# iptables -A INPUT -p tcp --dport 22 -s -j ACCEPT
# iptables -A INPUT -p tcp --dport 22 -j DROP

maybe you do have to adjust the parameters like the Lan ip addresses.

if your vpn users gets routed to eg you have to adjust that and add also

# iptables -A INPUT -p tcp --dport 22 -s -j ACCEPT

before you add the drop line, because if you do not, only packages on port 22 are accepted if the owner has either a or a localhost address.

  • Thanks for your answer. This was my first guess, but wouldn't this kill all the git accesses -- which happen to be on the same port? – RH6 Aug 7 '15 at 7:08
  • yes, but you can't say if it is a git over ssh access or a ssh access, because there is no difference between standard ssh access and git access, because it's standard ssh transfer, but normal and special git content – Schwertspize Aug 7 '15 at 7:59
  • True, but in my setup the git user is password-less (as explained in the redmine-git-hosting setup) and it has a git-shell behind, so attackers cannot go past this (sorry, I have forgotten mentioning this in the description!) – RH6 Aug 7 '15 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.