4

The instructions in help.ubuntu.com/community/SSH/OpenSSH/Configuring recommend disabling password authentication so that "it will only be possible to connect from computers you have specifically approved". But they don't say how to specifically approve a computer. How do I do that?

2 Answers 2

9

On each user you want to have access to the server, run in a terminal:

ssh-keygen
ssh-copy-id <username>@<serverIPorDNSname>

It will ask you where to save it, the default is just fine. It will ask you to enter a passphrase. This is to encrypt the key just in case the computer is stolen or compromised. If you do not want a passphrase, you leave both passphrase prompts blank.

The first command creates a ssh key for the current the user it is run on. The second command ssh's into the server and adds the the current user's key to the server's list of who is allowed to login. Since ssh-copy-id is using ssh, you will need to do this before you disable password logins.

SSH keys are two matching halves. One half is told to everyone, the other is kept secret. Using a mathematical algorithm, the public half can be used to decrypt data encrypted with the private key. If data decrypts successfully with the public key, you know beyond a doubt that it was the private half of the key that encrypted it. So when you login with a ssh key, the client sends a message (encrypted using the private key) that basically says "let me in". The server checks using the public key and if the public key is in the list of allowed computers the login is successful.

ssh-copy-id is (using ssh) copying the public half to the servers list of what keys are allowed to login (this list is stored at /home/<username>/.ssh/authorized_keys2, or in the case of root at /root/.ssh/authorized_keys2). If you already disabled password authentication, you can still add a computer. You just have to copy the public key (at /home/username/.ssh/id_rsa.pub on a client computer) to something like a USB stick and then add the contents of id_rsa.pub to the end of the /home/<username>/.ssh/authorized_keys2 file on the server. (You could do this by running command like cat /media/USB/stick/path/to/id_rsa.pub >>/home/<username>/.ssh/authorized_keys2 on the server.)

8
  • 1
    This is all good except it does not guarantee that only that computer with the key you generated will have access. Someone malicious or ill advised might copy your passwordless private key somewhere else and be able to use it.
    – asoundmove
    Jul 6, 2011 at 1:34
  • 1
    @asoundmove That is only if they get into your computer and you didn't set a passphrase.
    – Azendale
    Jul 6, 2011 at 4:42
  • 1
    +1, an example of cat /path/to/id_rsa.pub >>/home/<username>/.ssh/authorized_keys2 could be good to show in the answer.
    – enzotib
    Jul 6, 2011 at 7:59
  • I did it by following the instructions in linuxproblem.org/art_9.html to put the RSA public key of the computer to be approved in .ssh/authorized_keys on the computer running OpenSSH-server, before disabling password authentication on it. Jul 6, 2011 at 20:36
  • I don't understand why @enzotib deleted my answer (now in the previous comment) as "not an answer". Jul 6, 2011 at 20:37
0

Iptables

If the computers have a certain ip-range you could use iptables to control access. Iptables are part of the kernel. You can control them in the file /etc/iptables

# from /etc/iptables
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
#
# loopback device
#
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
#
# all connections already established (started outgoing from my machine)
#
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# but SSH - restricted
#
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 --source 138.232.0.0/255.255.0.0 -j ACCEPT
#
# block all others (without answering - thus nobody is able to scan the network)
#
-A INPUT -p icmp --icmp-type echo-request -j DROP
-A RH-Firewall-1-INPUT -j DROP
COMMIT

The interesting line is this one:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 --source 111.111.0.0/255.255.0.0 -j ACCEPT

Prot 22 is the default ssh port. If it's different with you machine, change it. 111.111.0.0/255.255.0.0 -j ACCEPT means it accepts all connections coming from '111.111.foo.bar' with 'foo' and 'bar' being any 3 digits.

3
  • -1. Using this approach, it's quite possible to spoof your IP address and get unauthorized access. This approach is unacceptable for authentication purposes, though it might be suitable as an additional line of defense. The correct approach to the OP's question is to use key-based authentication, as in Azendale's answer. Jul 6, 2011 at 8:11
  • @Scott, yes but it is a good complement to ssh keys as ssh does not control which computers originate the requests. So +1.
    – asoundmove
    Jul 6, 2011 at 12:45
  • @SCott: Also I never meant it to be the only line of defence. Ssh would still have it's own authentication method
    – con-f-use
    Jul 6, 2011 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .