OS: Ubuntu 14.04
I would like to root login from ssh locally, because backuppc needs that. I would like to block an external access with root login.
Thanks
OS: Ubuntu 14.04
I would like to root login from ssh locally, because backuppc needs that. I would like to block an external access with root login.
Thanks
You can do this using a Match
block in /etc/ssh/sshd_config
. First, make sure you have this line:
PermitRootLogin no
That will block root access. You can then allow it for your local network with this:
## Permit local root login
Match Address 192.168.1.*,127.0.0.1
PermitRootLogin yes
This assumes that your LAN gives IPs like 192.168.1.N
, if not, change accordingly. Also, I suggest you add this at the end of /etc/ssh/sshd_config
to make sure it does not conflict with other directives. Once you have done so, restart the ssh service (sudo service ssh restart
) and you will be able to ssh as root from local machines only.
Match All
if included mid-file.
Sep 12, 2016 at 11:59
Using this simple iptables rule, you can block the hosts not coming from your local network, my network is 192.168.122.0 so my rule will be:
iptables -A INPUT -i eth0 -p tcp --dport 22 ! -s 192.168.122.0/24 -j DROP
if you want block only a particular user from a source
in your /etc/ssh/sshd_config
AllowUsers [email protected].*
After dealing a lot with this issues I've found that with IP6 interaces you should proably need to add ::1 as localhost origin, even your "external" ip address if you depending of your /etc/hosts configuration
# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes
## Permit local root login
Match Address ::1,127.0.0.1,178.56.xx.xx
PermitRootLogin yes
Match All