5

I want to restrict ssh access on macOS 10.12 to selected IPs on my local network. I tried writing the following files:

# /etc/hosts.allow
sshd: 192.168.1.32
sshd: 192.168.1.33

# /etc/hosts.deny
sshd: ALL

Then restarting with:

sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
sudo launchctl load /System/Library/LaunchDaemons/ssh.plist

Unloading ssh.plist successfully disabled ssh, but after reloading I can still connect from any IP.

How can I configure an IP whitelist?

4

hosts.allow and hosts.deny are only used when you run the service (sshd) through TCP wrappers. The default macOS install does not do that, so they will not have any effect.

As recommended by other answers, you could use a firewall to restrict access to SSH. This could be a hardware (i.e. "external") firewall or a software firewall such as the built-in pf firewall.

However, I wouldn't recommend using a firewall only. The best is to limit the sshd service itself - and if you want, you can add the firewall protection to that. The reasoning behind that is that if for some reason your firewall gets disabled, outside users would suddenly be allowed access to communicate with sshd - you really do not want that.

In order to configure sshd to limit access, you will need to edit the file /etc/ssh/sshd_config, and add the following:

AllowUsers username@192.168.1.32 username@192.168.1.33

where you replace "username" with your actual username.

If you want you can replace parts with * to denote a wildcard, such as for example username@192.168.1.* or *@192.168.1.32. You can read more about the options in the man page for sshd_config.

  • I can't get past password authentification with this method. I am asked for my password 4 times then get the response Received disconnect from [...] port 22:2: Too many authentication failures – seven11 Nov 29 '18 at 19:34
  • Did you want to login with a password? - What is your username? Please paste the actual line you've added to sshd_config? – jksoegaard Nov 29 '18 at 20:07
  • I added AllowUsers admin@192.168.1.32 admin@192.168.1.33 and then attempted to connect with ssh admin@192.168.1.31. Without the filter, I type my admin password to login successfully. – seven11 Nov 29 '18 at 21:15
  • And the IP address of the PC you're trying to login from is what? - Can you confirm with the logs on the server that it is seeing the login from that IP? (in case you have multiple IPs) .. Have you restarted sshd after changing the configuration file? – jksoegaard Nov 29 '18 at 21:32
  • Yes, I restarted sshd with launchctl. Here is what I see when I connect without any restrictions on IP: sshd: Accepted keyboard-interactive/pam for admin from 192.168.1.32 port 38766 ssh2 – seven11 Nov 30 '18 at 11:17
2

hosts.allow and hosts.deny has been deprecated and you should be using a firewall (pf) instead.

The default rule for pf can be found in /etc/pf.conf. You could edit this file directory or create your own custom rule set, but be sure to copy the contents of the default file to it. Add the following two lines:

# The name of the network interface as shown in ifconfig
ext_if="en0"

tcp_services = "{ssh}"
icmp_types = "{echoreq, unreach}"
trusted = "{192.168.1.32, 192.168.1.33}"

# Exempt the loopback interface to prevent services that use if from being blocked
set skip on lo0

# This is a desktop so we have to be permissive in allowing outgoing  connections
pass out quick modulate state


# Block all incoming SSH Traffic by default 
  block in on $ext_if inet proto tcp from any to any port $tcp_services

# Allow SSH traffic from trusted IPs
pass in on $ext_if inet proto tcp from $trusted to any port $tcp_services

Next, enable pf with the command

$ sudo pfctl -e                                 #if using the default /etc/pf.conf
$ sudo pfctl -e -f /path/to/custom_pf.conf      #if using a custom pf.conf

This ruleset will by default, block SSH to all but the trusted IPs that are defined. All other services will not be impacted.

  • I edited /etc/pf.conf, then enabled pf with sudo pfctl -e -f /etc/pf.conf. Now I can't connect from my other machine: ssh admin@192.168.1.31 hangs forever. Also this blocks all traffic, I can't connect to any website with pf enabled. – seven11 Nov 29 '18 at 19:30
  • I've gone ahead and written a more comprehensive ruleset for a desktop setup. See my edits. – Allan Nov 29 '18 at 20:51
  • Thanks, I went with the other answer which was simpler to implement. – seven11 Nov 30 '18 at 12:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .