Iam using MacOS on the desktop and Ubuntu Linux on the server. I disabled root login over ssh and enabled ssh based public key login. However, I recently added second Ubuntu server. I need to sync file between two using rsync command. Is there any way that I can log from the second server into my first server with root user from second server IP address only ({[email protected] }# ssh [email protected]) without reducing OpenSSH server security option?
Yes, you can configure OpenSSH for root login from one IP address or subnet only using Match option. The Match option act as a conditional block. If all of the given conditions are satisfied, OpenSSH can override global section config file. You can limit or grant access to sshd features with the Match option.
Syntax
The syntax is pretty simple:
| Match condition <br /> Override config option 1<br /> Override config option 2<br /> |
You can use the following as condition:
- User – Specifies the user to match. For example, if user is root allow login with ssh-keys but disallow everyone else.
- Group – Specifies the group to match. For example, If user in group admin, allow login but disallow everyone else.
- Host – Specifies the host to match
- LocalAddress – Specifies and match the the local (listen) address and port upon which the incoming connection was received via LocalAddress and LocalPort clauses.
- LocalPort – Same as above.
- Address – Specifies the IP address or IP/subnet to match in CIDR format.
Where should I put Match configuration option?
You must add config option at the bottom of the config file i.e. /etc/ssh/sshd_config:
$ sudo vi /etc/ssh/sshd_config
OR
$ doas vi /etc/ssh/sshd_config
Example: Allow root login from from 192.168.2.5 with ssh-key but disallow everyone else
Append the following in your /etc/ssh/sshd_config:
| ## Block root login to every one ##<br />PermitRootLogin no<br /> <br />## No more password login ##<br />PermitEmptyPasswords no<br />PasswordAuthentication no<br /> <br />## Okay allow root login with public ssh key for 192.168.2.5 ##<br />Match Address 192.168.2.5<br /> PermitRootLogin yes |
|
YOU CAN SETUP MULTIPLE IP ADDRESS/CIDR AS FOLLOWS:
| PermitRootLogin no<br />PermitEmptyPasswords no<br />PasswordAuthentication no<br />Match Address 192.168.184.8,202.54.1.1,192.168.1.0/<span style="box-sizing: inherit;">24</span><br /> PermitRootLogin yes |
|
How do I setup conditional username along with an IP address?
You can combine User and Address condition as follows so that you can allow password login (a bad idea) including tunnel:
| ### somewhere already disabled everything ###<br />PasswordAuthentication no<br />PermitTunnel no<br />### but we are allowing user vivek from 192.168.1.0/<span style="box-sizing: inherit;">24</span> CIDR ###<br />Match User vivek Address 192.168.1.0/<span style="box-sizing: inherit;">24</span><br /> PermitTunnel yes<br /> PasswordAuthentication yes |
|
Using * and ! pattern
You can use the following patterns:
- * – It matches matches zero or more characters.
- ? – It matches exactly one character.
- ! – Patterns within pattern-lists may be negated with !.
Let us see some common examples of pattern matching
| ## Match 192.168.1.1 to 192.168.1.9 ##<br />Match Address 192.168.1.?<br /> PermitRootLogin yes<br /> <br />## Match 192.168.1.<span style="box-sizing: inherit;">{</span><span style="box-sizing: inherit;">2</span>,<span style="box-sizing: inherit;">3</span>....<span style="box-sizing: inherit;">}</span> ##<br />Match Address 192.168.2.* <br /> X11Forwarding no<br /> <br />## Allow any host in the <span style="box-sizing: inherit; color: #993333;">".home.lan"</span> set of domains ##<br />Match Host *.home.lan<br /> X11Forwarding yes<br /> <br />## Allow everyone except foo user ##<br />Match User *,!foo<br /> X11Forwarding yes<br /> PermitTunnel yes<br /> PermitTTY no |
|
A list of keywords that you can use following a Match condition
From the man page ~ available keywords are
- AcceptEnv
- AllowAgentForwarding
- AllowGroups
- AllowStreamLocalForwarding
- AllowTcpForwarding
- AllowUsers
- AuthenticationMethods
- AuthorizedKeysCommand
- AuthorizedKeysCommandUser
- AuthorizedKeysFile
- AuthorizedPrincipalsCommand
- AuthorizedPrincipalsCommandUser
- AuthorizedPrincipalsFile
- Banner
- ChrootDirectory
- DenyGroups
- DenyUsers
- ForceCommand
- GatewayPorts
- GSSAPIAuthentication
- HostbasedAcceptedKeyTypes
- HostbasedAuthentication
- HostbasedUsesNameFromPacketOnly
- IPQoS
- KbdInteractiveAuthentication
- KerberosAuthentication
- MaxAuthTries
- MaxSessions
- PasswordAuthentication
- PermitEmptyPasswords
- PermitOpen
- PermitRootLogin
- PermitTTY
- PermitTunnel
- PermitUserRC
- PubkeyAcceptedKeyTypes
- PubkeyAuthentication
- RekeyLimit
- RevokedKeys
- RhostsRSAAuthentication
- RSAAuthentication
- StreamLocalBindMask
- StreamLocalBindUnlink
- TrustedUserCAKeys
- X11DisplayOffset
- X11Forwarding
- X11UseLocalHost
A note about using firewall
| <span style="box-sizing: inherit; color: #666666; font-style: italic;">## Allow our subnet to access for 22 on this box using ufw ##</span><br /><span style="box-sizing: inherit; color: #c20cb9; font-weight: bold;">sudo</span> ufw allow from 192.168.1.0<span style="box-sizing: inherit; font-weight: bold;">/</span><span style="box-sizing: inherit;">24</span> to any port <span style="box-sizing: inherit;">22</span><br /> <br /><span style="box-sizing: inherit; color: #666666; font-style: italic;">## Allow (insert rule) my workstation to access port 22 on this server ##</span><br />iptables <span style="box-sizing: inherit; color: #660033;">-I</span> INPUT <span style="box-sizing: inherit; color: #660033;">-s</span> 192.168.2.5 <span style="box-sizing: inherit; color: #660033;">-p</span> tcp <span style="box-sizing: inherit; color: #660033;">-m</span> tcp <span style="box-sizing: inherit; color: #660033;">--dport</span> <span style="box-sizing: inherit;">22</span> <span style="box-sizing: inherit; color: #660033;">-j</span> ACCEPT<br /> <br /><span style="box-sizing: inherit; color: #666666; font-style: italic;">## Allow port 22 (append rule) ##</span><br />iptables <span style="box-sizing: inherit; color: #660033;">-A</span> INPUT <span style="box-sizing: inherit; color: #660033;">-s</span> 192.168.1.5 <span style="box-sizing: inherit; color: #660033;">-m</span> state <span style="box-sizing: inherit; color: #660033;">--state</span> NEW <span style="box-sizing: inherit; color: #660033;">-m</span> tcp <span style="box-sizing: inherit; color: #660033;">-p</span> tcp <span style="box-sizing: inherit; color: #660033;">--dport</span> <span style="box-sizing: inherit;">22</span> <span style="box-sizing: inherit; color: #660033;">-j</span> ACCEPT<br />iptables <span style="box-sizing: inherit; color: #660033;">-A</span> INPUT <span style="box-sizing: inherit; color: #660033;">-s</span> 192.168.1.0<span style="box-sizing: inherit; font-weight: bold;">/</span><span style="box-sizing: inherit;">24</span> <span style="box-sizing: inherit; color: #660033;">-m</span> state <span style="box-sizing: inherit; color: #660033;">--state</span> NEW <span style="box-sizing: inherit; color: #660033;">-p</span> tcp <span style="box-sizing: inherit; color: #660033;">--dport</span> <span style="box-sizing: inherit;">22</span> <span style="box-sizing: inherit; color: #660033;">-j</span> ACCEPT |
|
References
