SSH Security allowing only certain users to connect to the server [closed]

Question

I have set up a remote ssh server on the cloud. I am newb at these things and have managed to bypass the required firewall using SSH. Now I plan on giving the access to only 2 more friends of mine so as to share the costs of data transfer so that only 3 users at max can connect and only the friends. So my question is that How can I achieve this?

The server is running Ubuntu Linux. Also, the college has a static IP so each one gets a proxified IP. Is there any way that I can do MAC filtering over the Server?

Also, if you insist on using SSH KEYS, then would they restrict access if someone just copied the key and used it? Please also suggest a way, if the MAC spoofing could be bypassed?

Answer 1

You can't do MAC filtering unless all the clients are on the same network segment as the server (i.e. no router in between). This is not the case here; the server has no way to know the client's MAC address.

You can set up an IP-based filter with iptables (Linux's low-level firewall configuration command) or with one of its numerous frontends such as ufw, which the official firewall tool on Ubuntu.

Here's an ufw example, assuming you want to allow only addresses of the form 192.0.2.x and deny all other incoming connections:

ufw default deny incoming
ufw allow proto tcp from 192.0.2.0/24 to any port 22

This blocks connections before the SSH server even sees them. You may impose additional restrictions in the SSH server configuration. For example, you could allow the pranav account to log in from anywhere, and users in the friends group only from 192.0.2.x, and other users not at all. You can do this with the following configuration in /etc/ssh/sshd_config:

DenyUsers *
AllowUsers pranav
Match 192.0.2.0/24
    AllowGroups friends

You cannot prevent someone from giving their password or key to another person. If your friends do that, tell them they can't be your friends anymore after such a breach of trust.

Answer 2

The answer is in the SSH documentation.

SSH users are identified with a public/private key pair - you can copy the public key as much as you want, but it is of no use to you unless I enter the corresponding private key.