Restrict Remote SSH Login to IP

Question

Level 1

0 points

Restrict Remote SSH Login to IP

I would like to restrict SSH on my OS X 10.10 Mac to a particular IP or a subnet.

I have been messing around with pf.conf and turning the firewall on and off in system preferences to restart it to test.

I have been able to open particular ports like 2222 and 8080 to all with rules like :

# Open port 8080 for TCP on all interfaces

pass in proto tcp from any to any port 8080

# Open port 2222 for TCP on all interfaces

pass in proto tcp from any to any port 2222

But to selectively allow SSH from a specific IP with :

# Open port 22 from 123.456.789.10 for TCP on all interfaces

pass in proto tcp from 123.456.789.10 to any port 22

doesn't work.

It seems in order for SSH to answer at all, under Sharing in system preferences, remote login has to be enabled,

and to successfully login, remote login must be enabled for the user or group logging in.

When this is the case, my rule,

# Open port 22 from 123.456.789.10 for TCP on all interfaces

pass in proto tcp from 123.456.789.10 to any port 22

is not effective, I can SSH as the user specified from any host.

I can see by running

sudo dscl . -read /Groups/com.apple.access_ssh/

while adding and removing users to Sharing / remote login

that somehow SSH is plugged into the Directory server group management.

Is there any way to restrict SSH to an IP or IP range (or to a user AND IP/IP range)?

Thanks,

SG

iMac, OS X Yosemite (10.10), sshd, pf

Posted on Jan 20, 2016 4:13 PM

Reply

Answer 1

Best reply

Doug Niven1

Level 1

49 points

Sep 7, 2017 7:02 PM in response to spacegoose

You could create a new rule in /etc/pf.conf along these lines:

table <goodguys> { 111.222.0.0/16, 117.30.117.55 } persist

block in proto tcp from any to any port {22}

pass in on en0 proto tcp from <goodguys> to (en0) port {22} flags S/SA keep state

Then reload pfctl:

sudo pfctl -f /etc/pf.conf -e

Note OS upgrades may overwrite your pf.conf file!

Reply

Answer 2

rccharles

Level 6

12,957 points

Jan 20, 2016 9:28 PM in response to spacegoose

I'm a novice ssh user, but ...

man sshd_configure

AllowUsers

This keyword can be followed by a list of user name patterns, separated by spaces. If specified,

login is allowed only for user names that match one of the patterns. Only user names are valid; a

numerical user ID is not recognized. By default, login is allowed for all users. If the pattern

takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular

users from particular hosts. The allow/deny directives are processed in the following order:

DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

appears to be using openSSHD

hence:

http://www.unixlore.net/articles/five-minutes-to-even-more-secure-ssh.html

Reply

Answer 3

BobHarris

Level 9

53,003 points

Jan 21, 2016 6:21 AM in response to spacegoose

You should be able to specify the users that are allowed to connect via

You could also change the /etc/ssh/sshd_config to disable password logins and ONLY allow ssh-keygen created keys

...

PasswordAuthentication no

...

You will need to stop and restart sshd or send it a SIGHUP to get it to re-read the updated sshd_config file. (see 'man sshd' and 'man sshd_config').

I'm sorry, but I do not have any clues about pf.conf and restricting connections from IP addresses that are not your select range.

Reply

Answer 4

spacegoose Author

Level 1

0 points

Jan 21, 2016 9:16 AM in response to rccharles

Thanks for the replies. I realize I can restrict SSH to a user or a group and would be fine doing that via Sharing / remote login - if that's what I wanted. It is only part of what I want, which is, to restrict SSH login to an IP or a range of IPs, secondarily - restricting SSH to a user from an IP or range of IPs would also be nice.

The AllowUsers directive looks promising. I will test it.

It turns our my firewall rules for 2222 and 8080 were not effective either, I think those ports were being allowed due to the application firewall. I have a VM in VirtualBox running services on those ports, with forwarding enabled, and VirtualBox is specified in the application firewall. Removing the rules and restarting the firewall, I could still SSH to it via port 2222 and reach the web app on 8080, on removing VirtualBox from the application firewall, I could not.

Thanks,

SG

Reply

Answer 5

spacegoose Author

Level 1

0 points

Jan 21, 2016 10:02 AM in response to spacegoose

I tried AllowUsers foo@123.456.789.10 in sshd_config and it didn't work.

It's not clear if it's even possible to manually configure the firewall. It seems like it's really an application only firewall?

Regards,

SG

Reply

Answer 6

BobHarris

Level 9

53,003 points

Jan 21, 2016 10:40 AM in response to spacegoose

spacegoose wrote:

I tried AllowUsers foo@123.456.789.10 in sshd_config and it didn't work.

It's not clear if it's even possible to manually configure the firewall. It seems like it's really an application only firewall?

Regards,

SG

Did you restart sshd after changing the /etc/ssh/sshd_config file?

Just uncheck "Remote Login", and then re-check "Remote Login" in the Sharing preferences.

Reply

Answer 7

rccharles

Level 6

12,957 points

Jan 21, 2016 1:20 PM in response to spacegoose

I think you need to disallow all other user/ip addresses. etc.

Did you make this change in your vm? What os in the vm?

R

Reply

Answer 8

BobHarris

Level 9

53,003 points

Jan 21, 2016 5:37 PM in response to spacegoose

Maybe you should try a 'block', followed by a 'pass'. My limited google search reading says all are enabled by default. That all rules are read and a specific request may be denied, then allowed, then denied, allowed, etc... until the last rule is processed. So I'm suggesting you start by blocking all ssh access, then allow access from your subset of ports.

NOTE: The following is totally untested, and could be full of syntax errors

table <my_ssh_allow_table> { 123.456.789.10, 123.456.789.11, 192.168.1.0/24 }

block in all proto tcp to any port ssh

pass in proto tcp from <my_ssh_allow_table> to any port ssh

The <ssh_allow_set> has 2 specific IP address, and all typical local LAN addresses, assuming your router using 192.168.1.* as the local LAN IP address range. Adjust all the addresses accordingly.

Again, I do not have a clue if this is good syntax or not.

Reply

Answer 9

spacegoose Author

Level 1

0 points

Jan 28, 2016 4:17 PM in response to spacegoose

I think I am somewhat closer to getting things where I want them. I don't necessarily understand why it's working, I think before I wasn't seeing the pf.conf changes due to not loading and enabling the rules properly, so that was confusing things (the cheat sheet below helped with that). In any event, I don't think it's possible to restrict ssh on OS X 10.10 to a subnet when it runs on the default port 22. Also, there are several hooks with ssh, "remote login" + allowed users, with the directory and the firewall, the relationships between them aren't 100% clear. I'm not sure if it didn't work on 22 because it's a privileged port, or too tied into OS X.

I used the following:

http://marcel.zurreck.com/os-x-yosemite-change-ssh-port

http://krypted.com/mac-security/a-cheat-sheet-for-using-pf-in-os-x-lion-and-up/

to achieve something close. I have restricted ssh to a subnet on an alternate port. I don't enable remote login, but I do select my particular user there, which is still mysteriously necessary for successful login (this is tied into the local directory group mentioned earlier).

More info:

My firewall is on, stealth mode is enabled, no allowed apps are included in the app firewall, block all incoming box is unchecked.

My /etc/pf.conf looks like:

...

load anchor "com.apple" from "/etc/pf.anchors/com.apple"

#Possibly unnecessary but probably not dangerous

pass in quick on lo0 all

pass out quick on lo0 all

#Allow ping etc. from MY-NET

pass in quick on en0 proto icmp from 12.34.0.0/16

#VirtualBox VM (forwards to 22, 80)

pass in proto tcp from any to any port 8080

pass in proto tcp from any to any port 2222

#Explicitly block 60225 then allow it from MY-NET

block in proto tcp from any to any port 60225

pass in proto tcp from 12.34.0.0/16 to any port 60225

From cheat sheet (to work with pf.conf):

enable:

sudo pfctl -e

disable:

sudo pfctl -d

show rules:

sudo pfctl -sr

sanity check for errors:

sudo pfctl -v -n -f /etc/pf.conf

load new config:

sudo pfctl -f /etc/pf.conf

Reply