5

OS: Ubuntu 14.04

I would like to root login from ssh locally, because backuppc needs that. I would like to block an external access with root login.

Thanks

3
  • Do you need to be able to allow other users access from outside the LAN?
    – terdon
    May 10, 2014 at 16:32
  • yes one or 2 users only
    – user63726
    May 11, 2014 at 3:48
  • OK, my answer should work for you then. Access for non-root users is not affected but root can only log in from the local network.
    – terdon
    May 11, 2014 at 4:05

3 Answers 3

9

You can do this using a Match block in /etc/ssh/sshd_config. First, make sure you have this line:

PermitRootLogin no

That will block root access. You can then allow it for your local network with this:

## Permit local root login
Match Address 192.168.1.*,127.0.0.1
      PermitRootLogin yes

This assumes that your LAN gives IPs like 192.168.1.N, if not, change accordingly. Also, I suggest you add this at the end of /etc/ssh/sshd_config to make sure it does not conflict with other directives. Once you have done so, restart the ssh service (sudo service ssh restart) and you will be able to ssh as root from local machines only.

2
  • Thanks. Also can I do the following: AllowUsers @localhost @192.168.5.* user1 user1 .To allow only user1 and user2 to access the network from outside, but any user access from the inside?
    – user63726
    May 11, 2014 at 4:15
  • @terdon, it may also be terminated with Match All if included mid-file. Sep 12, 2016 at 11:59
1

Using this simple iptables rule, you can block the hosts not coming from your local network, my network is 192.168.122.0 so my rule will be:

iptables -A INPUT -i eth0 -p tcp --dport 22 ! -s 192.168.122.0/24 -j DROP

if you want block only a particular user from a source

in your /etc/ssh/sshd_config

AllowUsers [email protected].*
2
  • But that will block all access, not just root.
    – terdon
    May 10, 2014 at 16:44
  • For blocking specific users you do it in the config file if you want to block all external access do it in the firewall. you can do it in both for good measure. Mar 7, 2017 at 8:46
1

After dealing a lot with this issues I've found that with IP6 interaces you should proably need to add ::1 as localhost origin, even your "external" ip address if you depending of your /etc/hosts configuration

# Authentication:
LoginGraceTime 120
PermitRootLogin no
StrictModes yes

## Permit local root login
Match Address ::1,127.0.0.1,178.56.xx.xx
  PermitRootLogin yes
Match All

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .