Red Hat Enterprise Linux - Allow Root Login From a Specific IP Address Only

Title: Red Hat Enterprise Linux - Allow Root Login From a Specific IP Address Only
Object Name: mmr_kc-0119626
Document Type: Support Information
Original owner: KCS - Linux
Disclosure level: Public
Version state: final
FACT:Red Hat Enterprise Linux
GOAL:Restrict root SSH login to a single IP address
FIX:This can be accomplished with the use of PAM access controls.  There are two steps:

1. In /etc/pam.d/sshd, add the following line:

account    required

2. In /etc/security/access.conf, set up root access controls by adding the following two lines at the end of the file:

+ : root : IP_address
- : root : ALL

Replace "IP_address" with the IP address of the system from which root logins will be allowed.  Note that there is a space before and after each colon.  The first line allows root access from the specified IP address; the second line denies root access from everywhere else.  The order of these two lines is significant.  This will take effect immediately with no need to reboot or restart any daemons.

Login attempts that are blocked by this check will be logged in /var/log/secure:

Jul 15 16:51:42 hostname sshd[18241]: fatal: Access denied for user root by PAM account configuration

This method of access control is very flexible and powerful.  For example, if you should need to add a second allowed host at some point in the future, simply add its IP address to the first line:

+ : root : IP_address_1 IP_address_2
- : root : ALL

There are many other options, which are well documented within the access.conf file itself or its reference page.
0 (0)
Article Rating (No Votes)
Rate this article
There are no attachments for this article.
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
How to schedule crontab in Unix Operating Systems
Viewed 752 times since Fri, Jun 8, 2018
How To: Linux Hard Disk Encryption With LUKS [ cryptsetup Command ]
Viewed 1133 times since Fri, Jul 13, 2018
Linux: how to monitor the nofile limit
Viewed 895 times since Wed, Jul 25, 2018
Zabijanie wszystkich procesów użytkownika
Viewed 1083 times since Thu, May 24, 2018
Super Grub2 Disk
Viewed 982 times since Wed, May 22, 2019
Linux - How to unlock and reset user’s account
Viewed 709 times since Fri, Jun 8, 2018
Open SSL HowTo: Decode SSL Certificate
Viewed 689 times since Mon, Feb 18, 2019
Tip: SSD and Linux. Enable TRIM and check if it works
Viewed 980 times since Fri, May 15, 2020
Fix rpmdb: Thread died in Berkeley DB library
Viewed 740 times since Fri, Feb 14, 2020
How to manage Linux password expiry with the chage command
Viewed 719 times since Tue, Sep 11, 2018