42.3. Restricting Access to the SSH Server

By default, any UNIX user will be allowed to log in remotely to the SSH server on your system, or use it to upload and download files. On a mail server system or one that hosts websites, however, this may not be appropriate. You might want to allow most users to only log in to your POP3, FTP, or Usermin servers instead. Although it is possible to achieve this by giving them a shell like /bin/false, this could cause other problems with user Cron or At jobs.

Fortunately, the SSH server can be configured to restrict who can log in. Just follow these steps:

1.
On the module's main page, click on the Access Control icon to bring up a form listing allowed and denied users.

2.
To block everyone except a few users, enter a list of usernames separated by spaces into the Only allow users field. The * and ? wildcard characters can be used, so you could enter foo* to allow any user whose name starts with foo.

You can also deny SSH access for everyone except the members of some groups by filling in the Only allow members of groups field. Users who are secondary members of any matching groups will be allowed as well. If both fields are filled in, users specified in either will be allowed.

3.
You can also block only a few specific users or groups using the Deny users and Deny members of groups fields. Again, wildcards may be used and, if both fields are filled in, users from either will be denied.

4.
If you are running SSH, the fields Only allow client hosts and Deny client hosts will appear on the form as well. If filled in, the former tells the SSH server to reject any connections except those from the IP addresses or hostnames entered, while the latter tells it to deny only the hosts and addresses listed in the adjacent field. Both fields accept the * and ? wildcard characters.

If your system has OpenSSH installed, you can use the TCP-wrappers configuration files /etc/hosts.allow and /etc/hosts.deny to block untrusted clients. Unfortunately, there is not yet a standard Webmin module for editing these files.

5.
Click the Save button at the bottom of the page to update the SSH server configuration file and return to the main page.

6.
Hit the Apply Changes button to activate the new restrictions.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.12.149.119