59

I'm trying to link my new laptop running 11.10 to my old laptop running 8.04 through my router using SSH.

This question is asked and answered on ubuntuforums here:

http://ubuntuforums.org/showthread.php?t=1648965

I thought it would be helpful to have a more definitive answer here.

Note: I needed to first install openssh-server on the laptop I was trying to connect to and open up the SSH port in my firewall using firestarter.

Improve this question
2
  • can you please tell us what is not "definitive" enough about slooow's answer on that thread? Otherwise your question seems to ambiguous.
    – d_inevitable
    Mar 25, 2012 at 18:25
  • @d_inevitable For one, it's not the only answer and it's not otherwise indicated as the correct one. It's the one I would have chosen, but this is why I thought it'd be useful to migrate this question. It might also help to include general directions, or a helpful link, on configuring SSH between two local machines.
    – klenwell
    Mar 25, 2012 at 18:43

3 Answers 3

Reset to default
72

You can restrict access to your ssh server in many ways.

IMO the most important is to use ssh keys and disable password authentication.

See the following wiki pages for details

You can restrict access to a specific subnet in several ways. I will assume your ssh server is on subnet 192.168.0.0/16 with an ip address of 192.168.0.10 , adjust accordingly ;)

Router

One line of defense is to use a router. Be sure to disable UPnP and do not allow port forwarding.

SSH configuration

You can set several options in /etc/ssh/sshd_config. One is the listen address. If You set a listen address on your subnet. A private IP address is not routable over the internet.

ListenAddress 192.168.0.10

You can also use the AllowUsers

AllowUsers [email protected]/16

Somewhat related, you can also change the port

Port 1234

See: http://manpages.ubuntu.com/manpages/precise/man5/sshd_config.5.html

TCP wrapper

As outlined on the forums post, you can use TCP Wrapper . TCP wrapper uses 2 files, /etc/hosts.allow and /etc/hosts.deny

Edit /etc/hosts.allow and add your subnet

sshd : 192.168.0.

Edit /etc/hosts.deny , and deny all

ALL : ALL

See also: http://ubuntu-tutorials.com/2007/09/02/network-security-with-tcpwrappers-hostsallow-and-hostsdeny/

Firewall

Last you can firewall your server. You can use iptables, ufw, or gufw.

iptables

sudo iptables -I INPUT -p tcp --dport 22 -s 192.168.0.0/16 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j REJECT

Please do not use DROP in iptables.

ufw

sudo ufw allow from 192.168.0.0/16 to any port 22

ufw has a graphical interface: gufw

GUFW

Improve this answer
7
  • Some networks use 10.0.0.0 as IP address, in that case substitute 192.168.0.0/24 for 10.0.0.0/8 to allow for the range 10.0.0.0-10.255.255.255. If you want to allow a single IP only, use something like 192.168.1.2/32. A very verbose explanation can be found on [serverfault.com/q/49765/51929](How does Subnetting Work?)
    – Lekensteyn
    Apr 1, 2012 at 8:32
  • 1
    Please do not use DROP in iptables - See chiark.greenend.org.uk/~peterb/network/drop-vs-reject
    – Panther
    Mar 3, 2014 at 16:46
  • That page does not mention spoofed IPs as a possible reason to use DROP over REJECT. This answer on Sec.SE explains why it is not really relevant though (the source packets are larger than the returned packets).
    – Lekensteyn
    Mar 3, 2014 at 17:35
  • @Lekensteyn - I did not see a discussion for spoofed IP in that link. As you suggest, DDoS and spoofed IP are beyond this discussion and I am not convinced DROP is superior to REJECT for much of anything. DDos are complex and without information on the cause of the DDos it is impossible to defend. For example, I have seen WP used as a DDoS and solving the problem is in proper configuration of WP and little or nothing to do with iptables.
    – Panther
    Oct 5, 2015 at 15:23
  • 1
    ListenAddress seems like the simplest and most elegant solution
    – code_monk
    Oct 6, 2016 at 1:32
38

2020 UPDATE

Since this question, a less complex approach is now possible using the Match keyword, introduced in OpenSSH 6.5/6.5p1 (2014):

In the sshd config file (/etc/ssh/sshd_config in Debian and derived OS such as Ubuntu)

# Disable all auth by default
PasswordAuthentication no
PubkeyAuthentication no

[.. then, at the end of the file ..]

# Allow auth from local network
Match Address  192.168.1.*
    PubkeyAuthentication yes
    # if you want, you can even restrict to a specified user
    AllowUsers stephan

Tip: it's better to put your custom rules onto a file in /etc/ssh/sshd_config.d folder. Typically /etc/ssh/sshd_config.d/local_network_only.conf. This prevents conflicts when upgrading to a new version of ssh-server package changes sshd config file.

man sshd_config for more details

Improve this answer
3
  • 3
    For noobs like me, this file is located at /etc/ssh/sshd_config
    – Steven Magana-Zook
    Oct 3, 2021 at 18:52
  • 1
    In Debian systems, the Match part can be added to a file ending with .conf like /etc/ssh/sshd_config.d/match.conf This has the benefit that the original ssh_config does not need to be edited.
    – mrossi
    Jun 9, 2022 at 12:37
  • Would the be better than using the listen director to restrict connections to a specific IP? In my case, I run a wireguard VPN , so I think having ssh server listen only on the VPN IP address is enough of a restriction.
    – majorgear
    Aug 19, 2023 at 17:38
0

ssh(secure shell) is used to access and transfer data securely(used RSA_KEYS pair). You can access data using ssh in two ways 1. Command line 2. using file browser

Command Line: For this you don't need to install anything. First task is log-in into other computer.

ssh other_computer_username@other_computer_ip

This command will ask for a password which is the other computer's password(for specific user-name). You have just logged in to other computer's shell. Think this terminal is like your computer shell terminal. You can do everything using shell to other computer that can you do in your computer

File browser: You need to install openssh-server

sudo apt-get install openssh-server

To log-in go to file->connectToServer

enter image description here

Improve this answer
4
  • Command line directions were the first thing I tried. I was able to ping my other computer at its LAN IP. But when I try to SSH, it hangs. So I assume I have to configure my other computer to allow SSH access first.
    – klenwell
    Mar 25, 2012 at 18:51
  • make sure that your router does not block 22 port or ssh
    – shantanu
    Mar 25, 2012 at 19:42
  • thanks. I already knew everything you mentioned from experience, but it was a great ease to hear it simple and structured from someone else.
    – Evgenia Karunus
    Jul 30, 2015 at 14:39
  • Just FYI there are other ways to access ssh besides those two - programmatically and via the use of a tunnel for example.
    – NOCARRIER
    Oct 29, 2023 at 1:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .