Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

We have several dedicated servers.

We need to ensure "root" user can not be accessible through SSH outside of LAN.

I have searched and found the followings #

We need exactly the root user will be unable to access outside of LAN. but other users will be accessible outside of LAN. Because other users can do their work only within their scope.

Our OS details

# cat /proc/version
Linux version 2.6.18-308.4.1.el5PAE (mockbuild@builder10.centos.org) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-52)) #1 SMP Tue Apr 17 17:47:38 EDT 2012

Please help me to resolve the issue?

share|improve this question
Firstly, configuration questions are not really on-topic here at Sec.SE. Secondly, have you done ANY research on the topic at all? A simple Google search will show you several ways to accomplish this. – Terry Chia Nov 15 '12 at 5:01
@TerryChia, thanks for comment. I have edited my answer as your comment. I searched this topic on internet, but i didn't get the exact solution. please help me to resolve the issue. Thanks. – Mahbubur R Aaman Nov 15 '12 at 6:40
What OS are you running? Restricting root access for SSH can usually be done by tinkering with the ssh config files. – Terry Chia Nov 15 '12 at 6:47
@TerryChia, I am using CentOS. Details added in my question. – Mahbubur R Aaman Nov 15 '12 at 8:44

closed as off topic by Terry Chia, Jeff Ferland♦ Nov 15 '12 at 7:22

Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

1 Answer

up vote 4 down vote accepted

This is exactly what you want, I googled: only allow root ssh lan

First hit... http://drsavoye.blogspot.com/2010/06/enable-root-login-from-lan-only.html

On Linux, edit /etc/ssh/sshd_config. On Macs, edit /etc/sshd_config. Locate the line that defines PermitRootLogin, uncomment if it is commented out, and change its value to yes.

On a separate line, add the following:

Match Address 192.168.2.*,127.0.0.1 PermitRootLogin yes

Of course, changing 192.168.2 to match your LAN subnet.

share|improve this answer
To don't restrict this "research" on one vendor: If you bing' it, you'll the the same result. ;) – Manuel Faux Nov 15 '12 at 7:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.