21

Can someone please tell me how to restrict SSH access only to certain IP ranges (e.g. local network) and not the whole Internet? I guess this has to be done via firewall.

|improve this question
23

From man sshd:

/etc/hosts.allow
/etc/hosts.deny
Access controls that should be enforced by tcp-wrappers are defined here.  
Further details are described in hosts_access(5).

https://debian-administration.org/article/87/Keeping_SSH_access_secure offers these examples:

# /etc/hosts.allow
sshd: 1.2.3.0/255.255.255.0
sshd: 192.168.0.0/255.255.255.0

# /etc/hosts.deny
sshd: ALL

The TCP wrapper program in Mac OS X is: tcpd

|improve this answer
  • Does this work on MacOS? My man sshd says nothing about /etc/hosts.allow. – Michael - Where's Clay Shirky 2 days ago
  • 1
    This answer is 8 years old. It worked at the time. I don't know what the current solution is, unfortunately. – TJ Luoma 2 days ago
  • Yeah, sorry. I eventually realized that between OpenBSD 5.5 (man.openbsd.org) and 5.6 it must have been removed. – Michael - Where's Clay Shirky 2 days ago
3

I did not test this, but I'd try this in terminal:

sudo ipfw add allow src-ip 10.0.0.0/8,172.16.0.0/16,192.168.0.0/16 dst-ip me dst-port 22
sudo ipfw add reject src-ip any dst-ip me dst-port 22
|improve this answer
1

If you are behind a router and didn't map the port to your computer, that effectively disables SSH access from the internet.

|improve this answer
  • Yes, I am aware of that. Unfortunately this isn't really a solution for me as this is for my MacBook Pro which occasionally is connected to networks with external IP and no router in-between. – Michal M Dec 18 '11 at 23:20
  • 1
    That seems very unlikely, and assuming you only have one network adapter, that would imply there is no 'local' network if a public IP address is bound to it. – Gerry Dec 18 '11 at 23:25
  • Unlikely or not, doesn't really matter, does it? Apart from external IP situation, consider Public WiFi networks. I know which networks are safe for me and I'd like to restrict access to only these networks. My question is a little more generic though which was my intention. – Michal M Dec 18 '11 at 23:30
  • I'd suggest rephrasing the question then. Sounds like you are looking to whitelist (some) IP ranges for some services in the firewall. – Gerry Dec 19 '11 at 9:07
  • Done as suggested. Cheers. – Michal M Dec 19 '11 at 9:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .