To fobid access trought ssh

[Alberto Pozuelo]

Hi,

We have a server called MACHINE Blade870 operating system hp-uxv2 (machine HP-UX B.11.23 U ia64 4032246291 unlimited-user license). I installed the latest version of SSH (T1471AA, A.05.20.014, HP-UX Secure Shell) and now I want to forbid access from any computer or server to this server in 2 ways:

At the level of host
At the user level

The idea that I would like to implement would be: if I am a simple user, I can only access if you have the public key MACHINE MACHINE. How can I do this? Is my reasoning correct? What other ideas do you offer me?

Thanks & Regards.

[kobylka]

Hello ssh!


There are many ways to restrict access to a (ssh) server:


1. Use sshd_config with
AllowUsers (allows USER@HOST notation)
AllowGroups

These are useful for whitelist creation which is ALWAYS more secure than a blacklist using their counterparts:

DenyUsers
DenyGroups

2. Use tcpwrappers
https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=TCPWRAP

3. If you run sshd as an inetd based daemon you can filter hosts using inetd.sec (man inetd.sec)

4. For host based filtering you can use system wide firewall rules (man ipf)

5. Use pam (man sshd_config and man pam)


Kind regards,

Kobylka

[Fred K. Abell Jr._1]

To deny hosts, I like the TCPwrappers mentioned above. The hosts.deny file will have in it ALL:ALL:DENY, then the hosts.allow files will select which hosts to let in.