SSH access restricted by IP

[linuxpyro]

Hello, I have a strange situation with the OpenSSH server which I have not been able to find much info on. Is it possible to restrict a certain group of users to log in from only one IP address? I know it's possible to only allow logins from one IP, but I would like to only have this for users of one group.

Can this work?

Thanks in advance.

[HeXiLeD]

Yes and it can be done with iptables in a fast way. allowing only the wanted ip to connect to sshd/port and droping everything else to that port/service.

you may also want to check these:

www.faqs.org/docs/securing/chap15sec121.html
http://gentoo-wiki.com/HOWTO_Protect_SSHD_with_Swatch

for more security you may also want to check about these options:
LoginGraceTime
PermitRootLogin <no>
StrictModes
MaxAuthTries
Allow users
RhostsRSAAuthentication
PasswordAuthentication
PermitEmptyPassword
_________________
Do you hear the sound of inevitability?
With age, comes great grumpiness and that, was 20 years ago...

CertFP: becbbd161d5a5c31de3c45171b77bf710911db29 / d985d21f89fe2977b593c4d381a1a86802e62990d9328d893db76d59f9935244

[linuxpyro]

This is a little tough to explain; I'm sorry for being a little unclear. I want to have it set up so users who are members of a particular group can only log into SSH from one IP. I have another group of users who I want to be able to log in from anywhere.

If I could override the host option in the ssh_config file for a handful of users, that would be great.

Thanks for the info, though; I'll keep at it.

[HeXiLeD]

Read a bit on how to use /etc/hosts.allow and /etc/hosts.deny . You can also use them for what you want to do.
_________________
Do you hear the sound of inevitability?
With age, comes great grumpiness and that, was 20 years ago...

CertFP: becbbd161d5a5c31de3c45171b77bf710911db29 / d985d21f89fe2977b593c4d381a1a86802e62990d9328d893db76d59f9935244

[hanj]

[think4urs11]