To protect my Debian servers, I'd liked to lock access of username ‘root’ to only IP addresses(or ranges) listed in a ‘whitelist’ file. But getting locked out of my server is even worse than getting hacked. And as I travel a lot, I must have a couple good ways add or change the IP addresses in that whitelist file.
1: Is the ssh sshd_config file the best way to limit the IP addresses?
And if I create a new user, example named ‘AltRootUser’ and give him full root permissions, but NOT limited to any IP, then I could login as him to edit the sshd_config file?
2: As a second way of updating the allowed IP addresses, I'm thinking of some secret webforn, where I enter a special password, and a new IP address. Then I could write a script that would take that IP address and add it to the whitelist. Is this doable or are there already any such scripts or tips on doing this?