topic Restrict Root access by IP address in Operating System - Linux

Restrict Root access by IP address

Nigel Mushet — Fri, 19 Jan 2007 02:54:35 GMT

I would like to restrict login by root to specfied ip addresses(the workstations in the IT department).

Please advise how best to achieve this.

Thanks

Re: Restrict Root access by IP address

Alexander Chuzhoy — Fri, 19 Jan 2007 04:30:28 GMT

You didn't specify the type of login ssh, telnet,etc?
If it's one of above - you can achieve this easily with /etc/hosts.deny (to deny login) or /etc/hosts.allow to allow login.

see examples here:
http://www.rhce2b.com/clublinux/RHCE-33.shtml

Re: Restrict Root access by IP address

Atul Gautam — Fri, 19 Jan 2007 04:40:34 GMT

Hi Nigel,

Better you configure SSH and restrict root login from anywhere....

What you can do is that you can create a common user account and from that you can "su" to your root account.

In /etc/ssh/sshd_config file, add a clause which is -- AllowUsers using which you can restrict the access to few IP Addresses only.

There's a clause which is PermitRootLogin, we need to set it to "no" to restrict root access.

I'm attaching a sample file for you which you can take a look at it.....

Do let me know bout any queries...

Atul

Re: Restrict Root access by IP address

Alpha977 — Fri, 19 Jan 2007 04:45:52 GMT

Hello Nigel!

i do the same with IPTables.

http://www.netfilter.org/projects/iptables/index.html

Regards.

Re: Restrict Root access by IP address

Rick Garland — Fri, 19 Jan 2007 17:38:02 GMT

How about restrict everybody from login as root but allow 'su -'

Set up the /etc/securetty file for console only.

Direct login as root is allowed only from console. Users can 'su -' to the root account.

Re: Restrict Root access by IP address

Nigel Mushet — Mon, 22 Jan 2007 00:25:43 GMT

Thanks for your replies:

Alexander

We are using telnet to login. form what I understand the host.allow and hosts.deny allows one to control what networks can have access. In my case I would want everyone to have access to the server but restrict direct login to root to a few specific IP addresses. I am not clear on how one would do this in these files - can "root" be used as a service keyword ?

Atul

I will have to investigate SSH - never set this up before. I can't open your attachment (I am on a very slow link...)

Alpha977

I will have to investigate iptables as I have never used this function.

Rick

I am using HPUX11 and do not have a /etc/securetyy file - should this be available un HPUX ?

Re: Restrict Root access by IP address

Nigel Mushet — Thu, 01 Feb 2007 03:10:54 GMT

Will need to do further investigation