20

Can someone please tell me how to restrict SSH access only to certain IP ranges (e.g. local network) and not the whole Internet? I guess this has to be done via firewall.

23

From man sshd:

/etc/hosts.allow
/etc/hosts.deny
Access controls that should be enforced by tcp-wrappers are defined here.  
Further details are described in hosts_access(5).

https://debian-administration.org/article/87/Keeping_SSH_access_secure offers these examples:

# /etc/hosts.allow
sshd: 1.2.3.0/255.255.255.0
sshd: 192.168.0.0/255.255.255.0

# /etc/hosts.deny
sshd: ALL

The TCP wrapper program in Mac OS X is: tcpd

3

I did not test this, but I'd try this in terminal:

sudo ipfw add allow src-ip 10.0.0.0/8,172.16.0.0/16,192.168.0.0/16 dst-ip me dst-port 22
sudo ipfw add reject src-ip any dst-ip me dst-port 22
1

If you are behind a router and didn't map the port to your computer, that effectively disables SSH access from the internet.

  • Yes, I am aware of that. Unfortunately this isn't really a solution for me as this is for my MacBook Pro which occasionally is connected to networks with external IP and no router in-between. – Michal M Dec 18 '11 at 23:20
  • 1
    That seems very unlikely, and assuming you only have one network adapter, that would imply there is no 'local' network if a public IP address is bound to it. – Gerry Dec 18 '11 at 23:25
  • Unlikely or not, doesn't really matter, does it? Apart from external IP situation, consider Public WiFi networks. I know which networks are safe for me and I'd like to restrict access to only these networks. My question is a little more generic though which was my intention. – Michal M Dec 18 '11 at 23:30
  • I'd suggest rephrasing the question then. Sounds like you are looking to whitelist (some) IP ranges for some services in the firewall. – Gerry Dec 19 '11 at 9:07
  • Done as suggested. Cheers. – Michal M Dec 19 '11 at 9:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .