Task: restrict SSH access to this server for specific users, or conversely, allow access only for specific users. Change the SSH port. Change the address that the SSHd daemon "listens" on.
For all these actions we need the sshd_config file open for editing:
/etc/ssh/sshd_configThis path is the same for both Linux (Debian/RHEL) and FreeBSD.
After changing the options — save the file and restart the SSHd daemon.
Changing the portThis is handled by the option:
Port 22
change 22 to the port you need, and make sure the option isn't commented out.
Changing the address the daemon listens onThis is handled by the options:
ListenAddress 0.0.0.0
Instead of 0.0.0.0 (which means "listen on all addresses") enter the addresses you need — one address per option line. Here's an example:
ListenAddress 192.168.0.1
ListenAddress 11.22.33.44
ListenAddress 127.0.0.1
Denying access to specific usersList the users in the DenyUsers option, separated by spaces. These are users for whom SSH login is blocked even if they have the specified shell.
DenyUsers user1 user2 user3
Allowing access only to specific usersList the users in the AllowUsers option, separated by spaces. If the option isn't defined, access is open to all users except those listed in DenyUsers. If the option is defined, access is open only to the users listed in it.
AllowUsers user1 user2 user3
Superuser root accessThe PermitRootLogin option determines whether logging in to this server as the root user is allowed. It's recommended to disable it, to reduce the chance of a successful brute-force attack — everyone knows the root user exists, but it's unknown what other admin accounts might exist on your server, which makes the attacker's job harder.
PermitRootLogin no
By default, "yes" is set for all Linux systems and "no" for FreeBSD.
Restarting the SSHd daemonFor Debian/Ubuntu:
$ sudo /etc/init.d/ssh restart
For CentOS/RedHat:
$ sudo /etc/init.d/sshd restart
For FreeBSD:
$ sudo /etc/rc.d/sshd restart
Comments