SSH access limitation ( IP address )

[Roro_2]

Hi,

I am willing to limit the access of ssh on HPUX 11i server to some IP addresses .
I tried to set " listen address " option in sshd_config file , but i did not work.
Please could someone help me.

Roger

[Ivan Krastev · Accepted solution]

ListenAddress is for ssh daemon if you have more than one IP on the server.

For restrictions use Allow/Deny Groups or use IPFilter to restrict by IP.

See documentation about sshd_config options - http://docs.hp.com/en/T1471-90015/ch01s14.html

and IPFilter admin guide - http://docs.hp.com/en/B9901-90014/index.html


regards,
ivan

[Steven E. Protter]

Shalom Roger,

tcpwrapper from http://software.hp.com can be used to limit ssh access by ip address or hostname.

It is somewhat easier to use than IPFilter which is also a very good solution.

SEP

[Roro_2]

Hi Ivan,

Where can i find Allow/Deny groups


Roger

[Jeeshan]

you can use /var/adm/inetd.sec to allow or deny for specific services with ip address

[Ivan Krastev]

Roro:

In file /etc/opt/ssh/sshd_config

After any change restart ssh daemon.


regards,
ivan

[Roro_2]

Hi Ivan,

I did not find "Allow/Deny Groups" option in sshd_config.

Roger

[Ivan Krastev]

In the link above there are configuration items and explanation - http://docs.hp.com/en/T1471-90015/ch01s14.html

For example use :
AllowGroups sshusers

where sshusers is a system group.

regards,
ivan

[vinodan]

Dear Roro,

If you want to limit certain Ips then you can /etc/hosts.allow and /etc/hosts.deny files .Put a + in /etc/hosts.deny which will
deny all IP addresses . Then mention the IPs which you want to allow in hosts.allow .

Vinod

[boomer_2]

hi Steven,
I couldnt find the tcp wrapper on hp's site...for 11i v2....

Only for tru64 its mentioned...

[boomer_2]

hi vinod,
for me smehow /etc/hosts.allow and /etc/hosts.deny doesnt wrk ....

Can u be a more specific as to whether ne other entry elcewhere is to be made..........????

[Dennis Handly]

>boomer: I couldn't find the tcp wrapper

Instead of asking questions in an old thread you should create your own and possibly add a link to the old one, if it provides details.
That way you can award points for helpful answers.

[boomer_2]

hi Dennis,
u r absltly rite.....
to be frank for a moment, thought it was my thread ..since i too had raised d same questn..sorry again.....
will definitely award u points if u answer my question :-) posted in this forum with subject being "How to block specific ip's access to my prodn server..."