Jtdylktuy

I know how to restrict SSH access to a system. How can I restrict SSH access to ANOTHER system when a user has logged in to my system. For example:

# ssh joe@myserver

# joe@myserver $ /home/joe

# joe@myserver $ /home/joe ssh joe@anotherserver

# BLOCK THIS ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I'm looking at IPTables now but I'm not sure of the implications of blocking outgoing port 22.

You should OK to block outgoing SSH if you don't need it for anything. Blocking outgoing requests on port 22 will not block incoming requests (because blocking is done on the destination port, which is different to the source port).

I've not played around with it much, but on some versions of iptables it should also be possible to block connections based on the userid, with a command like

 iptables -I INPUT -p tcp --dport 22 -m owner -uid XXX -j DROP

To find the uid, you can look in the password file, with a command like

 grep "username" /etc/passwd | cut -f3 -d":"

You have a different option in centos 6 and Centos 7

Many of us use TCP wrapper, iptables and firewalld

TCP wrapper Example

/etc/hosts.allow



sshd : IP-Address

Iptables Example

iptables -I INPUT -s x.x.x.x --dport 22 -j ACCEPT

iptables -I OUTPUT -d x.x.x.x --sport 22 -j ACCEPT

IPTABLES -A INPUT --dport 22 -j DROP

IPTABLES -A OUTPUT --sport 22 -j DROP

then run below command

service iptables save

Firewalld Example

systemctl start firewalld.service

systemctl enable firewalld.service

firewall-cmd –zone=”trusted” –add-source=<external IP 1>

firewall-cmd –zone=”trusted” –add-source=<external IP 1> –permanent

firewall-cmd –zone=”trusted” –add-source=<external IP 2>

firewall-cmd –zone=”trusted” –add-source=<external IP 2> –permanent

firewall-cmd –zone=”trusted” –add-service=ssh

firewall-cmd –zone=”trusted” –add-service=ssh –permanent

firewall-cmd –zone=”trusted” –list-all

firewall-cmd –zone=public –remove-service=ssh

firewall-cmd –zone=public –remove-service=ssh –permanent

You can block all SSH communication through iptables and allow for particular IP ADDRESS.

In below example,

First two rule is to allow for particular IP Address.

x.x.x.x - Your system IP

Last two rules, will block SSH connection for all IP address.

iptables -I INPUT -s x.x.x.x --dport ssh -j ACCEPT

iptables -I OUTPUT -d x.x.x.x --sport ssh -j ACCEPT

IPTABLES -A INPUT --dport ssh -j DROP

IPTABLES -A OUTPUT --sport ssh -j DROP