FACT:Red Hat Enterprise Linux
GOAL:Restrict root SSH login to a single IP address
CAUSE:
FIX:This can be accomplished with the use of PAM access controls. There are two steps: 1. In /etc/pam.d/sshd, add the following line: account required pam_access.so 2. In /etc/security/access.conf, set up root access controls by adding the following two lines at the end of the file: + : root : IP_address - : root : ALL Replace "IP_address" with the IP address of the system from which root logins will be allowed. Note that there is a space before and after each colon. The first line allows root access from the specified IP address; the second line denies root access from everywhere else. The order of these two lines is significant. This will take effect immediately with no need to reboot or restart any daemons. Login attempts that are blocked by this check will be logged in /var/log/secure: Jul 15 16:51:42 hostname sshd[18241]: fatal: Access denied for user root by PAM account configuration This method of access control is very flexible and powerful. For example, if you should need to add a second allowed host at some point in the future, simply add its IP address to the first line: + : root : IP_address_1 IP_address_2 - : root : ALL There are many other options, which are well documented within the access.conf file itself or its reference page.
Article Number: 400
Posted: Wed, Oct 3, 2018 4:00 PM
Last Updated: Wed, Oct 3, 2018 4:00 PM
Online URL: http://kb.ictbanking.net/article.php?id=400