Can someone please tell me how to restrict SSH access only to certain IP ranges (e.g. local network) and not the whole Internet? I guess this has to be done via firewall.
20
23
From man sshd:
/etc/hosts.allow
/etc/hosts.deny
Access controls that should be enforced by tcp-wrappers are defined here.
Further details are described in hosts_access(5).
https://debian-administration.org/article/87/Keeping_SSH_access_secure offers these examples:
# /etc/hosts.allow
sshd: 1.2.3.0/255.255.255.0
sshd: 192.168.0.0/255.255.255.0
# /etc/hosts.deny
sshd: ALL
The TCP wrapper program in Mac OS X is: tcpd
3
I did not test this, but I'd try this in terminal:
sudo ipfw add allow src-ip 10.0.0.0/8,172.16.0.0/16,192.168.0.0/16 dst-ip me dst-port 22
sudo ipfw add reject src-ip any dst-ip me dst-port 22
1
If you are behind a router and didn't map the port to your computer, that effectively disables SSH access from the internet.
-
Yes, I am aware of that. Unfortunately this isn't really a solution for me as this is for my MacBook Pro which occasionally is connected to networks with external IP and no router in-between. – Michal M Dec 18 '11 at 23:20
-
1That seems very unlikely, and assuming you only have one network adapter, that would imply there is no 'local' network if a public IP address is bound to it. – Gerry Dec 18 '11 at 23:25
-
Unlikely or not, doesn't really matter, does it? Apart from external IP situation, consider Public WiFi networks. I know which networks are safe for me and I'd like to restrict access to only these networks. My question is a little more generic though which was my intention. – Michal M Dec 18 '11 at 23:30
-
I'd suggest rephrasing the question then. Sounds like you are looking to whitelist (some) IP ranges for some services in the firewall. – Gerry Dec 19 '11 at 9:07
-
