Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have several dedicated servers.

We need to ensure "root" user can not be accessible through SSH outside of LAN.

I have searched and found the followings #

We need exactly the root user will be unable to access outside of LAN. but other users will be accessible outside of LAN. Because other users can do their work only within their scope.

Our OS details

# cat /proc/version
Linux version 2.6.18-308.4.1.el5PAE (mockbuild@builder10.centos.org) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-52)) #1 SMP Tue Apr 17 17:47:38 EDT 2012

Please help me to resolve the issue?

share|improve this question
    
Firstly, configuration questions are not really on-topic here at Sec.SE. Secondly, have you done ANY research on the topic at all? A simple Google search will show you several ways to accomplish this. –  Terry Chia Nov 15 '12 at 5:01
    
@TerryChia, thanks for comment. I have edited my answer as your comment. I searched this topic on internet, but i didn't get the exact solution. please help me to resolve the issue. Thanks. –  Mahbubur R Aaman Nov 15 '12 at 6:40
    
add comment

closed as off topic by Terry Chia, Jeff Ferland Nov 15 '12 at 7:22

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 5 down vote accepted

This is exactly what you want, I googled: only allow root ssh lan

First hit... http://drsavoye.blogspot.com/2010/06/enable-root-login-from-lan-only.html

On Linux, edit /etc/ssh/sshd_config. On Macs, edit /etc/sshd_config. Locate the line that defines PermitRootLogin, uncomment if it is commented out, and change its value to yes.

On a separate line, add the following:

Match Address 192.168.2.*,127.0.0.1 PermitRootLogin yes

Of course, changing 192.168.2 to match your LAN subnet.

share|improve this answer
    
To don't restrict this "research" on one vendor: If you bing' it, you'll the the same result. ;) –  Manuel Faux Nov 15 '12 at 7:43
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.