Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have set up a remote ssh server on the cloud. I am newb at these things and have managed to bypass the required firewall using SSH. Now I plan on giving the access to only 2 more friends of mine so as to share the costs of data transfer so that only 3 users at max can connect and only the friends. So my question is that How can I achieve this?

The server is running Ubuntu Linux. Also, the college has a static IP so each one gets a proxified IP. Is there any way that I can do MAC filtering over the Server?

Also, if you insist on using SSH KEYS, then would they restrict access if someone just copied the key and used it? Please also suggest a way, if the MAC spoofing could be bypassed?

share|improve this question

closed as unclear what you're asking by Noordung, Adnan, Xander, Steve, Scott Pack Mar 8 at 0:25

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

up vote 3 down vote accepted

You can't do MAC filtering unless all the clients are on the same network segment as the server (i.e. no router in between). This is not the case here; the server has no way to know the client's MAC address.

You can set up an IP-based filter with iptables (Linux's low-level firewall configuration command) or with one of its numerous frontends such as ufw, which the official firewall tool on Ubuntu.

Here's an ufw example, assuming you want to allow only addresses of the form 192.0.2.x and deny all other incoming connections:

ufw default deny incoming
ufw allow proto tcp from 192.0.2.0/24 to any port 22

This blocks connections before the SSH server even sees them. You may impose additional restrictions in the SSH server configuration. For example, you could allow the pranav account to log in from anywhere, and users in the friends group only from 192.0.2.x, and other users not at all. You can do this with the following configuration in /etc/ssh/sshd_config:

DenyUsers *
AllowUsers pranav
Match 192.0.2.0/24
    AllowGroups friends

You cannot prevent someone from giving their password or key to another person. If your friends do that, tell them they can't be your friends anymore after such a breach of trust.

share|improve this answer
    
Thanks, for such detailed explanation. But since, the proxy (Before Firewall) assigns an IP to us, so can't there be any other kind of filteration? –  Pranav Jituri Mar 7 at 15:48

The answer is in the SSH documentation.

SSH users are identified with a public/private key pair - you can copy the public key as much as you want, but it is of no use to you unless I enter the corresponding private key.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.