Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have several dedicated servers.

We need to ensure "root" user can not be accessible through SSH outside of LAN.

I have searched and found the followings #

We need exactly the root user will be unable to access outside of LAN. but other users will be accessible outside of LAN. Because other users can do their work only within their scope.

Our OS details

# cat /proc/version
Linux version 2.6.18-308.4.1.el5PAE ( (gcc version 4.1.2 20080704 (Red Hat 4.1.2-52)) #1 SMP Tue Apr 17 17:47:38 EDT 2012

Please help me to resolve the issue?

share|improve this question

closed as off topic by Terry Chia, Jeff Ferland Nov 15 '12 at 7:22

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Firstly, configuration questions are not really on-topic here at Sec.SE. Secondly, have you done ANY research on the topic at all? A simple Google search will show you several ways to accomplish this. – Terry Chia Nov 15 '12 at 5:01
@TerryChia, thanks for comment. I have edited my answer as your comment. I searched this topic on internet, but i didn't get the exact solution. please help me to resolve the issue. Thanks. – Md. Mahbubur R. Aaman Nov 15 '12 at 6:40
up vote 6 down vote accepted

This is exactly what you want, I googled: only allow root ssh lan

First hit...

On Linux, edit /etc/ssh/sshd_config. On Macs, edit /etc/sshd_config. Locate the line that defines PermitRootLogin, uncomment if it is commented out, and change its value to yes.

On a separate line, add the following:

Match Address 192.168.2.*, PermitRootLogin yes

Of course, changing 192.168.2 to match your LAN subnet.

share|improve this answer
The main PermitRootLogin option should be no (only the second one should by yes). – branoholy Oct 24 '15 at 0:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.