topic Re: SSH in Operating System - HP-UX

SSH

Krish_4 — Wed, 09 Mar 2005 14:08:18 GMT

Hi,

When system has multiple IP addresses configured ssh daemon listens on all ip's. How to configure ssh to listen on particular IP address?

Thanks.

Re: SSH

Steven E. Protter — Wed, 09 Mar 2005 14:19:50 GMT

By default ssh will listen on all IP addresses.

Openssh has a file called sshd_config

This file may allow you to make those kind of configurations.

I might approach it differently and use ipfilter or maybe even /var/adm/inetd.sec to block protocols aimed at certain ip addresses.

I know Ipfilter could handle the job easily.

SEP

Re: SSH

Biswajit Tripathy — Wed, 09 Mar 2005 14:31:39 GMT

One way is to use IPFilter. If S_IP is the server IP
you want to bind to and 22 is the port # where sshd
is listening on, use the following IPFilter rules:

# /sbin/ipf -f-
pass in quick proto tcp from any to S_IP port = 22
pass out quick proto tcp from S_IP port = 22 to any
block in proto tcp from any to any port = 22
block out proto tcp from any port = 22 to any

- Biswajit

Re: SSH

Steven E. Protter — Wed, 09 Mar 2005 14:39:09 GMT

Doh.

That file I mentioned

/opt/ssh/etc/sshd_config

#Port 22
Protocol 2
#ListenAddress 0.0.0.0
#ListenAddress ::

I pretty much bet if you change the ListenAddress to the IP in question and then restart the sshd daemon, you will get the job done a lot faster than by installing and configuring IPFilter.

Sorry.

SEP

Re: SSH

Biswajit Tripathy — Wed, 09 Mar 2005 14:41:10 GMT

You could simplify the rule I posted in my last post
to the following:

# /sbin/ipf -Fa -f-
block in quick proto tcp from any to !S_IP port = 22
block out quick proto tcp from !S_IP port = 22 to any

(That's a '!' char immediately before the IP address).

- Biswajit

Re: SSH

Biswajit Tripathy — Wed, 09 Mar 2005 14:45:08 GMT

Steven E Protter wrote:
> I pretty much bet if you change the ListenAddress
> to the IP in question and then restart the sshd
> daemon, you will get the job done a lot faster than
> by installing and configuring IPFilter.

I agree with you on this as far as HP-UX 11.11 (or
11i, v1) is concerned. On HP-UX 11i v2 (i.e 11.23)
IPFilter is a default installed product, so it should
already be there on your system.

- Biswajit