nixCraft

chandanperl · #1 (**permalink**) 07-25-2008, 02:10 PM

Hi,
I am root and i dont want anybody access me via SSH service remotly.
How can i do that?

Thanks

amitabh · #2 (**permalink**) 07-25-2008, 06:02 PM

Block the SSH port (normally 22) on your firewall

chandanperl · #3 (**permalink**) 07-25-2008, 06:53 PM

Hi,
Thanks a lot.can u send me that firewall rule?

Quote:

Originally Posted by amitabh

Block the SSH port (normally 22) on your firewall

nixcraft · #4 (**permalink**) 07-26-2008, 06:21 AM

Firewall usually blocks access using IPs or state and other conditions. Under Fedora Linux open /etc/sysconfig/iptables file and find out line with port 22 with ACCEPT action. Change this to DROP or REJECT:

Code:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j REJECT

Restart firewall:

Code:

service iptables restart

Note that no one able to use your ssh now over Lan or the Internet. If you need to skip LAN subnet (192.168.1.0/24) try as follows:

Code:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s ! 192.168.1.0/24 -j REJECT

If iptables is too hard for you try:
Restrict ssh access using tcpd (TCPWrapper)

amitabh · #5 (**permalink**) 07-26-2008, 07:45 AM

If you are actually thinking of blocking the SSH entirely, why not disable the sshd service itself?

chandanperl · #6 (**permalink**) 07-26-2008, 12:01 PM

Thanks,
Its working.I just want to allow only two ip for accessing root through ssh service.

Quote:

Originally Posted by nixcraft

Firewall usually blocks access using IPs or state and other conditions. Under Fedora Linux open /etc/sysconfig/iptables file and find out line with port 22 with ACCEPT action. Change this to DROP or REJECT:

Code:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j REJECT

Restart firewall:

Code:

service iptables restart

Note that no one able to use your ssh now over Lan or the Internet. If you need to skip LAN subnet (192.168.1.0/24) try as follows:

Code:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s ! 192.168.1.0/24 -j REJECT

If iptables is too hard for you try:
Restrict ssh access using tcpd (TCPWrapper)

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
howto block mail service for a user	ephdia	Databases servers	0	07-17-2008 11:26 AM
How to Block Ultrasurf	laluvirtual	Linux software	9	06-15-2008 05:21 PM
Add normal user / FTP user usein NORMAL user(non-root)	anilvrathod	Shell scripting	0	12-07-2007 07:04 PM
Block Single User Login using root password	sayan4u86	Networking, Firewalls and Security	0	09-28-2007 07:47 AM
Iptables block ip address	raj	Getting started tutorials	0	05-05-2007 02:01 AM

nixCraft

block ssh to remote user

block ssh to remote user

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Similar Threads