What is the easiest way to make it so that the only way anyone could access the ssh or ftp for my ubuntu machine is to be on a certain ip address?
1
-
tcpwrapper will do this very easily, /etc/hosts.allow and /etc/hosts.deny . See askubuntu.com/questions/407405/… and cyberciti.biz/faq/tcp-wrappers-hosts-allow-deny-tutorial . Not all services use tcp wrapper , but ssh and ftp both do, so simple set or rules. If you need rules we need more details.– PantherJan 16, 2018 at 3:26
Add a comment
|
2 Answers
Ubuntu Firewall (ufw).
See if Ubuntu Firewall is active:
$ sudo ufw status
If it's inactive, enable it:
$ sudo ufw enable
Allow SSH connections from a specific IP address:
$ sudo ufw allow from 123.123.123.123 to any port 22 proto tcp
Allow FTP connections
$ sudo ufw allow from 123.123.123.123 to any port 21 proto tcp
View firewall rules:
$ sudo ufw status
Delete above SSH rule:
$ sudo ufw delete allow from 123.123.123.123 to any port 22 proto tcp
Disable Ubuntu Firewall:
$ sudo ufw disable
answered Jan 15, 2018 at 22:43
-
UFW is Uncomplicated FireWall. UFW isn't "active" it's a program one installs to write iptables rules more simply, a varnish if you will, that configures the netfilter firewall.
ufw enabletells ufw to enable the firewall, for example.– pbhjJan 15, 2018 at 22:51 -
2Ah, ok. Good to know. I haven't looked at the documentation lately, but I've always called it "Ubuntu Firewall". I don't think the author himself is too fussed about what UFW stands for: "What does it mean? It has come to mean 'Uncomplicated Firewall', but you can change it to something more suitable if you want. If you like it, you might pick 'Universal Firewall', or 'Ultimate Firewall'. If you are not a fan, perhaps 'Unbearable Firewall'. Have fun!" Jan 17, 2018 at 10:48
-
How do I allow all connections from my local network? I have a dynamic ip so if I did the normal ip address it would eventually change and I'd be locked out. I've also tried using a DNS that points to my dyn ip but it gave an error "Bad source address".– kevCAIJan 17, 2018 at 15:52
-
1If your LAN is 192.168.0.x, you can allow from all LAN addresses using:
sudo ufw allow from 192.168.0.0/24 to any port 22 proto tcp- this is assuming your SSH server is on the LAN and you're trying to access it using the LAN IP address, not some external IP address that is forwarded to the LAN address. Jan 19, 2018 at 10:44 -
@kevCAI you can put a netblock in, so have the allowed IP address swapped for your ISPs netblock; often that info can be found from
whois $ipaddresswhere $ipaddress is your own IP.– pbhjJan 21, 2018 at 20:52
The easiest way is using the firewall. DigitalOcean has a great tutorial on configuring ufw.
First make sure ufw is enabled, if not enable it:
sudo ufw status
sudo ufw enable
The relevant command for ssh/ftp from one address would be
sudo ufw allow from 15.15.15.15 to any port 22
sudo ufw allow from 15.15.15.15 to any port 21
Port 22 is the defaut for SSH, 21 is the default for FTP. You can replace 15.15.15.15 by either a subnet you want or a specific IP.
