Assuming that the users have dynamic IPs (so I can't whitelist) and that setting up a VPN is not an option, is it a valid approach to restrict access to an administration area by only allowing IPs that are currently connected via SSH on the server? Are there any security issues with this?

What if the server in which the user is logged in via SSH isn't the same as the site's server. Is it OK to have the site call a service on that other server that would tell if an specific IP is logged in? Any implications that I'm not aware of?

PS: I'd still be asking for password over SSL and implementing other basic security measures, the question is about restricting access.

PPS: I understand the usability issues, assume users are always logged in via SSH.

  • 1
    Are you talking about sudo access, or an area on a website, or what? May 8 '14 at 17:58
  • An area on a website. I run a few sites out of a VPS and most of the time I'm with a SSH session opened, so I figured this could be used to restrict the access to the admin area that I have to access in the browser.
    – Schrute
    May 8 '14 at 21:43

only allowing IPs that are currently connected via SSH

An IP address does not equal a person. What is someone is using public wifi at a coffee shop? Several dozen people could be sharing his IP address.

  • good point! i'd still be asking for password though
    – Schrute
    May 8 '14 at 16:02

If you cannot block by IP address then you need something else. You could use pki or you could use strong authentication. Preferably you would use both. You would either issue keys and control them or you would have a process in place to establish trust with a key generated on the system. Also make sure you are enforcing good password security. You could also look at some sort of ldap integration and have some sort of two-factor authentication.

You definitely want your SSH server to be on a DMZ if you will be allowing blanket access to the system from the internet. Limit its access to the rest of your network, harden it and keep it patched. That way you have a chance to limit the damage if it gets cracked.


What about client certificates? It side-steps the need for checking IPs. Only those with the certificate can log in.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.