Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 3 down vote favorite
2

Can someone please tell me how to restrict SSH access only to certain IP ranges (e.g. local network) and not the whole Internet? I guess this has to be done via firewall.

share|improve this question

3 Answers

up vote 4 down vote accepted

From man sshd:

/etc/hosts.allow
/etc/hosts.deny
Access controls that should be enforced by tcp-wrappers are defined here.  
Further details are described in hosts_access(5).

http://www.debian-administration.org/articles/87 offers these examples:

# /etc/hosts.allow
sshd: 1.2.3.0/255.255.255.0
sshd: 192.168.0.0/255.255.255.0

# /etc/hosts.deny
sshd: ALL

The tcp wrapper program in Mac OS X is tcpd

share|improve this answer
up vote 0 down vote

If you are behind a router and didn't map the port to your computer, that effectively disables SSH access from the internet.

share|improve this answer
Yes, I am aware of that. Unfortunately this isn't really a solution for me as this is for my MacBook Pro which occasionally is connected to networks with external IP and no router in-between. – Michal M Dec 18 '11 at 23:20
1  
That seems very unlikely, and assuming you only have one network adapter, that would imply there is no 'local' network if a public IP address is bound to it. – Gerry Dec 18 '11 at 23:25
Unlikely or not, doesn't really matter, does it? Apart from external IP situation, consider Public WiFi networks. I know which networks are safe for me and I'd like to restrict access to only these networks. My question is a little more generic though which was my intention. – Michal M Dec 18 '11 at 23:30
I'd suggest rephrasing the question then. Sounds like you are looking to whitelist (some) IP ranges for some services in the firewall. – Gerry Dec 19 '11 at 9:07
Done as suggested. Cheers. – Michal M Dec 19 '11 at 9:15
up vote -1 down vote

I did not test this, but I'd try this in terminal:

sudo ipfw add allow src-ip 10.0.0.0/8,172.16.0.0/16,192.168.0.0/16 dst-ip me dst-port 22
sudo ipfw add reject src-ip any dst-ip me dst-port 22
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.