Four ways of SSH restricting login

ssh Four ways to restrict login

1、xinetd service

To configure /etc/hosts.allow and hosts.deny

[root@centos7 ~]# hostname -I
192.168.75.171 
[root@centos7 ~]# vim /etc/hosts.allow 
all:192.168.75.160:allow
all:192.168.75.1:allow   # Operate in the virtual machine , Remember to add host , or ssh It will interrupt , commit suicide 
[root@centos7 ~]# cat /etc/hosts.deny
all:all:deny

[root@centos7 ~]# systemctl restart xinetd
[root@centos7 ~]# systemctl restart sshd



[root@CentOS6 ~]# hostname -I
192.168.75.160 
[root@CentOS6 ~]# ssh [email protected]
[email protected]'s password: 
Last login: Wed Nov  3 20:35:38 2021 from 192.168.75.160  # Normal login 
[root@centos7 ~]# 

[root@centos7 ~]# hostname -I
192.168.75.170 
[root@centos7 ~]# ssh [email protected]
ssh_exchange_identification: read: Connection reset by peer # Unable to login 

2、iptables

# iptables -t filter -A INPUT -s 1.1.1.1 -d `hostname -I` -p tcp --dport 22 -j ACCEPT
# iptables -t filter -A INPUT -p tcp --dport 22 -j DROP

3、 By modifying the sshd_config The configuration file AllowUsers Realization

AllowUsers
 This command is followed by a list of user names separated by spaces ( You can use "*" and "?" wildcard ). By default, all users are allowed to log in .
 If this instruction is used , Then only these users will be allowed to log in , And reject all other users .
 If you specify  USER@HOST  Mode user , that  USER  and  HOST  Will be checked at the same time .
 Only the user's name is allowed here, not UID. dependent  allow/deny  Instructions are processed in the following order ：
DenyUsers, AllowUsers, DenyGroups, AllowGroups

[root@centos7 ~]# vim /etc/ssh/sshd_config
# Add the following address at the end , Each address is separated by a space 
AllowUsers *@10.213.53.40 *@10.213.53.41 *@10.213.53.42 *@10.213.53.43 *@10.213.53.44 *@10.213.53.45 *@11.234.* *@11.2.2.*
[root@centos7 ~]# systemctl restart sshd

4、 Set login blacklist

[root@centos7 ~]# vi /etc/pam.d/sshd
# Additional 
auth required /lib/security/pam_listfile.so item=user sense=deny file=/etc/sshd_user_deny_list onerr=succeed
 all /etc/sshd_user_deny_list Users inside are rejected ssh Sign in