3

How can I limit ssh login for a specific user to be allowed from just one IP address?

I have a user named foo in server with e.g. IP address 127.0.0.5 (my first server) and I left its login via ssh only by public key. I want to only grant access login to this user from a specific IP (which is my another server), e.g. IP 127.0.0.6.

How is it possible?

AdminBee
  • 21,637
  • 21
  • 47
  • 71
Alireza Azad
  • 31
  • 1
  • 3
  • 5
    Does this answer your question? [Limit SSH access to specific clients by IP address](https://unix.stackexchange.com/questions/406245/limit-ssh-access-to-specific-clients-by-ip-address) – Jesse Nickles Jun 01 '22 at 19:31

2 Answers2

2

You can change the configuration of sshd, in /etc/ssh/sshd_config:

AllowUsers [email protected] [email protected] ....

You can also select that some user can use only some authentication methods:

Match User my_login
AuthenticationMethods publickey

But carefully on both points: you should have physical control or being very carefully before changing any settings. And I recommend you also to look the manual page for AllowUsers ans AuthenticationMethods options, in order to understand better the implications, and eventually additionally options and methods you need.

Giacomo Catenazzi
  • 2,630
  • 9
  • 15
0

You could set up a firewall and allow only a certain IP to connect to port 22:

/etc/nftables.conf

#!/usr/sbin/nft -f

flush ruleset

table inet firewall {

    chain inbound {
        # By default, drop all traffic unless it meets a filter
        # criteria specified by the rules that follow below.
        type filter hook input priority 0; policy drop;

        # Allow traffic from established and related packets.
        ct state established,related accept

        # Drop invalid packets.
        ct state invalid drop

        # Allow loopback traffic.
        iifname lo accept

        # Allow all ICMP and IGMP traffic, but enforce a rate limit
        # to help prevent some types of flood attacks.
        ip protocol icmp limit rate 4/second accept
        ip6 nexthdr ipv6-icmp limit rate 4/second accept
        ip protocol igmp limit rate 4/second accept

        # Allow SSH on port 22 but only from 127.0.0.6
        ip saddr 127.0.0.6 tcp dport 22 accept
    }

    chain forward {
        # Drop everything (assumes this device is not a router)
        type filter hook forward priority 0; policy drop;
    }

    chain outbound {
        # Allow all outbound traffic
        type filter hook output priority 0; policy accept;
    }
}
dirdi
  • 134
  • 6