Day: November 9, 2020

by

Allow SSH Root Login From Selected IP Addresses

To secure your system better by allowing selected hosts to ssh into your system as root, you will need the Match keyword found in the /etc/ssh/sshd_config

For example, to allow only 192.168.x to be able to ssh into the system, you do the following. If you are using

Edit the SSH Config

% vim /etc/ssh/sshd_config

1. By IP Addresses

PermitRootLogin no
.....
.....
# Example of overriding settings on a per-user basis
Match Address 192.168.*,172.21.1.1
PermitRootlogin yes

2. By Host Name

PermitRootLogin no
UseDNS yes
.....
.....
# Example of overriding settings on a per-user basis
Match Host *.example.com,host1.idontknow.com
PermitRootlogin yes

3. By User and IP Addresses

PermitRootLogin no
UseDNS yes
.....
.....
# Example of overriding settings on a per-user basis
Match User user1 Host *.example.com
PermitRootlogin yes

Restart SSH Service

% systemctl restart sshd.service

References:

  1. Linux: Allow SSH Root Login From Specific IP
  2. How to restrict ssh logins by user and client address on CentOS/RHEL
  3. Limit access to openssh features with the Match option