Want to cut off SSH access to a Linux server? If you are a Linux administrator, you will know the usefulness of one connections SSH that allows you to have root operations on remote systems.
Due to the importance of the function it is very likely that you have already taken many measures to lock down SSH access. The use of an SSH key for control identity αντί για ένα απλό password, και η αλλαγή της default SSH port (22), may be the first steps you need to take, but it is not enough.
Below we will see one more step you can take. It is so easy and obvious that most managers forget that it exists as an option. This step does not require third-party software and can be configured in seconds.
What you will need
You should also have access to the remote server console in case something goes wrong and you are locked out, like every time you tease SSH.
The first thing we need to do is allow the IP address of any client that needs SSH access to the remote server. Once you have a list of IP addresses, you can add them to /etc/hosts.allow. To do this, run the command:
su
Enter the root password, and
nano /etc/hosts.allow
At the bottom of this file, add the following:
sshd: IP
Where IP is the IP address of the remote client that needs access to the server. If you have multiple IP addresses, you can enter them as follows:
sshd: 100.53.33.77/30, 100.73.152.9/22, 100.92.100.11/51, 100.22.192.0/44
Or something like this:
sshd: 192.168.1.1/24
sshd:127.0.0.1
sshd: [::1]
Save and close the file. Nano storage is done by typing CTRL + X together, then y, and Enter
How to block all other addresses
Now that we have allowed an IP address or a list of addresses, it is time to block all other addresses. One thing you need to know is that one system Linux reads the hosts.allow file first (from top to bottom), followed by hosts.deny (from top to bottom). So an SSH connection attempt from an IP address present in hosts.allow will be allowed, even though hosts.deny might block all IPs.
So, to block all other IP addresses, open the required file with the command:
nano /etc/hosts.deny
At the bottom of this file, add the following:
sshd: ALL
