Re: How can I block IP address range with sshd_config

From: Jeff Vian (jvian10_at_charter.net)
Date: 07/27/04

  • Next message: Hesty P: "lm_sensors not working" 
    To: For users of Fedora Core releases <fedora-list@redhat.com>
Date: Tue, 27 Jul 2004 12:56:40 -0500

    On Tue, 2004-07-27 at 11:43, Michael Sullivan wrote:
    > I've been reading over the hosts.deny man page to get some ideas, but
    > I'm unclear on how to implement them. I know what I want to do, but I
    > don't know how to do it. I want to allow all connections from my five
    > users, those being acsacx, amy, michael, wayne and zack, unless those
    > requests come from 211.182.241.* These acceptable accounts will likely
    > only log in through ssh. I want to deny 211.182.241.* unconditonally.
    > Can anyone give me an example of a hosts.allow/hosts.deny setup that
    > would do this?
    >

    ALL: 211.182.241.0/255.255.255.0

    (I believe there are other working syntaxes for the line as well.)
    put into the hosts.deny file would deny all access to hosts in the range
    you listed for all services that use tcp wrappers for access control.
    and would leave all other access unrestricted.

    IMHO a simpler and better way would be to use a rule in iptables that
    would deny access to all hosts in that range. It then applies to all
    connection attempts, not just those using tcp wrappers.
     
    >
    > On Tue, 2004-07-27 at 11:12, Michael Sullivan wrote:
    > > The kiddies using their script file to try to hack into my systems
    > > through sshd using accounts guest and test tried again yesterday. This
    > > morning I opened up the man page for sshd_config in Konquerer (the
    > > colour coding is very nice) and discovered how I could deny access
    > > through ssh from all accounts except the accounts that might use it
    > > (this excludes guest and test). The other day I went in to each of the
    > > user accounts and modified their .bashrc file so that when they log in
    > > it asks them to change their password and boot them out. This will work
    > > for now because for now the enemy script is only trying to inquire about
    > > the nonexistent guest and test accounts. The IP addresses they try to
    > > log in from vary slightly, but for the most part I think the first three
    > > octets are the same. I looked through the man page for sshd_config for
    > > a way to block their IP, but I couldn't find it. Does anyone here know
    > > how to do this?
    >
    The AllowUsers option in the /etc/ssh/sshd_config file can be used to
    explicitly specify a list of those users who can use ssh, (If used, NO
    other users can connect with ssh.) You also can specify connection with
    a key and a passphrase if you wish to better control authorized access.

    man sshd_config is your friend, as well as reading the comments in the
    default /etc/ssh/sshd_config file. 

    -- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: Hesty P: "lm_sensors not working"

    Relevant Pages

    • Re: ssh security
      ... what are valid accounts and what are not. ... It's considered axiomatic that security ... > system accounts (and over 99.9% are root, which does not get ssh access ... There are even some bots and apps that attack you from different IP ...
      (Fedora)
    • Re: Hacked mac
      ... Secret accounts? ... Re-install the system using Archive and Install. ... Some would argue that this isn't reasonably safe. ... When you turn ssh back on, either take steps to make sure every ...
      (comp.sys.mac.system)
    • Re: Options to block brute force attacks
      ... They would be unlikely to guess my root password, but who knows, I do ... I'm assuming that you have already limited SSH login to normal user ... accounts, excluding direct login to role accounts. ... theory, an attacker could break it, given enough time. ...
      (comp.security.ssh)
    • Re: mail program for FC6
      ... And I find the ability to drag messages among folders on different accounts on different machines to be much more convenient than whatever method you might use in mutt to accomplish that. ... it via SSH and putty from any Windows machine - I keep putty and my SSH ... This covers a lot more than email, but another approach to get better access than putty/ssh from a remote machine is with freenx on the fedora side and the NX client locally. ...
      (Fedora)
    • Re: Login system with php
      ... > i need 3 accounts: ... > This is a small web site, so i can't use SSL; ... > means, that a 'reader' can access all the admin part of the site, but will ... > I was wondering if somedody could give me a trick to deny access to the ...
      (comp.lang.php)