<div dir="ltr"><div><div>Good morning Jim,<br><br>What distro are you running on? I am RHEL based and have always configured ssh access through /etc/ssh/sshd_config. If you limit access through ssh you have no impact on your console login.<br><br></div>See section 3:<br><a href="http://wiki.centos.org/HowTos/Network/SecuringSSH">http://wiki.centos.org/HowTos/Network/SecuringSSH</a><br><br></div>Good luck!<br><br>Matt<br><br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr">---------<br><b style="color:rgb(51,102,102)">Matthew Campbell</b><br><font size="1">Storage and Cloud Strategy<br>Office of the CTO<br></font><font face="Verdana" size="1"><br></font><b><span style="color:rgb(51,102,102)">Kaiser Permanente</span></b><br><font size="1">99 S. Oakland<br>Pasadena, CA 91101<br></font><br><font size="1"><a>626-564-7228</a> (office)<br></font><font face="Verdana" size="1"><a>8-338-7228</a> (tie-line)<br><a value="+18186918895">818-314-9897</a> (mobile phone)<br>Green Center 3-North, 031W29</font><font size="1"><br></font>---------<br><b><a style="color:rgb(51,102,102)" href="http://kp.org/thrive" target="_blank">kp.org/thrive</a></b><br></div></div></div>
<br><div class="gmail_quote">On Thu, Nov 13, 2014 at 10:22 AM, DYN: Jim Workman <span dir="ltr"><<a href="mailto:jimw@dynashoe.com" target="_blank">jimw@dynashoe.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal">Hi All,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">My RHEL server has both internal and external Ethernet connections. We are trying to limit outside SSH access to specific users.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p>So, in access.conf, can I add:<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>+ : johndoe boba sams : ALL # To allow specific users from any IP<u></u><u></u></p>
<p>+ : ALL : <a href="http://10.0.0.0/255.255.255.0" target="_blank">10.0.0.0/255.255.255.0</a> # To allow all users from local network<u></u><u></u></p>
<p>- : ALL : ALL except LOCAL # Deny everyone else except (on the console?)<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>If I try this, is there a chance that I won’t even be able to login as root on the console?<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>Should it accomplish my goal? <u></u><u></u></p>
<p><u></u> <u></u></p>
<p>Would it affect other areas such as email, cron-tasks, etc?<span class="HOEnZb"><font color="#888888"><u></u><u></u></font></span></p><span class="HOEnZb"><font color="#888888">
<p><u></u> <u></u></p>
<p>Jim<u></u><u></u></p>
<p><u></u> <u></u></p>
<p><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</font></span></div>
</div>
</blockquote></div><br></div>