Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am about to install 10.04 (from bare metal to replace 9.04) and I want to set it up so that I can shh into the machine, but only from other machines on my local network. (I.e., I want to reject all ssh attempts from other than 192.168.1 set of IPs.) How do I do that correctly on 10.04?

share|improve this question
The hosts.allow/deny answers are correct, but it also makes sense for your home gateway/router to silently ignore all inbound packets from port 22 (and most other ports too). – msw Aug 14 '10 at 14:54
@msw: I did already have my router set up to silently ignore incoming requests, but putting that tip here was a good idea. Thanks! – vanden Aug 14 '10 at 15:51
up vote 10 down vote accepted

You have to edit the two configuration files /etc/hosts.allow and /etc/hosts.deny (you can get a detailed explanation of the format with man hosts_access):


sshd: 192.168.1.


sshd: ALL

In both cases you could replace sshd with ALL, then these rules would not only apply to the ssh server but to all other daemons that might be running.

share|improve this answer

In addition to using hosts.allow and hosts.deny, you can use firewalls. "ufw" is installed by default in Ubuntu. You enable it with

sudo ufw enable

and then limit the ssh connectivity with `

sudo ufw allow from to any app OpenSSH

That should do it. I believe the FireStarter application will allow a GUI configuration of ufw as well.

share|improve this answer
is it worth mentioning that the application profile is now "OpenSSH"? – user8979 Mar 9 '11 at 22:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.