Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have some ubuntu cloud servers running and has the iptable rules applied on them to allow only few ip addresses to connect via ssh. I know how to generate SSH-key for connecting to server with/without passphrase. My manager is asking if there is any some sort of certification login which allows to connect to the cloud computers which doesn't require changing iptable rules everytime. Does anyone know this with SSH or with something?. Please let me know...

share|improve this question
    
I don't understand - if iptables only allows certain addresses, then only those addresses can connect. If you want to be able to constantly connect to the server with other machines, then you'd need to drop the iptables idea (IMO, I'm no expert). –  htorque May 26 '11 at 6:53

1 Answer 1

up vote 4 down vote accepted

You could disable password-based login on the ssh server and remove the iptables rules. Nobody will then be able to brute-force a password-login because it's disabled, but trusted users with their key-pairs would be able to login from everywhere.

To limit the usage of the keys, you can specify which hosts they can be used from with the from parameter in front of the key in authorized_keys, for instance:

from="255.255.255.255" ssh-rsa ASDFqwerty[...]
share|improve this answer
    
Moreover, it wouldn't have any problem removing ipables rules if I have set only for SSH, but i'm blocking many ports and also allowing some ports other than ssh. –  user3215 May 26 '11 at 11:57
    
Then leave the current ruleset in place, but create a rule that accepts the ssh-connections before the other rules. –  Egil May 26 '11 at 12:03
    
I didn't get yoy exactly. Then in that case if a new user wants to access should I again change the iptables rules to allow ssh for the new user's ip? –  user3215 May 26 '11 at 12:35
1  
The ssh server listens on port 22 and will take logins for any user. Opening port 22 tcp will let all requests get to the ssh server. Then the ssh server will decide if you can login based on what ssh keys are authorized and (if you do the from= thing) where the connection is coming from. tl;dr : Opening tcp port 22 will be all the iptables config you need. When you want to add a new user, you will just have to update the ssh config to add the key for the new user. BTW: the authorized keys file mentioned is usually in /home/username/.ssh/ (or for root /root/.ssh). See 'man authorized_keys' –  Azendale May 26 '11 at 15:05
1  
You need to back it up like other important data. However, removing a hidden dot-folder like .ssh accidentally is quite unlikely. Of course, you could run a regular cron-script to check the health of all the users keys and restore them if need be. –  Egil May 26 '11 at 18:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.