ssh from public internet and firewalls

Michael Velez mikev777 at hotmail.com
Tue Jan 18 23:26:18 UTC 2005


Hello all,

 

I have set up sshd on my RHEL 3 box to be able to ssh to it from the
internet.  All rules on the modem, router, and RHEL work fine.  However, I
would like to add a rule to my firewall that only certain MAC addresses can
actually make a request to sshd, thereby limiting ssh's from the public
internet to two trusted laptops.

 

I have set up my firewall with the mac address option and have put in the
mac addresses of those laptops.  The problem is that this works fine when
the laptops are connecting from within my LAN (i.e. firewall accepts/rejects
specific MAC addresses - not a great help there but I guess I'm protected
from any devious family member) but it does not work when my laptop is
connecting from the public internet?  Is there a reason? Will the MAC
address reflect the one from the latest hop; that is, will my Linux box only
see the router MAC address?  There seems to be a MAC option in the
sshd_config; is that the answer and how do I use that?

 

Also, can I set up two different authentication mechanisms for whether I'm
logging in from within my LAN or from the internet?  There is a HOST keyword
for the sshd_config file.  Can I set up two pseudo-hosts to go verify two
different identities with one of the hosts only accepting local IP addresses
or something else that's local that I can define?  The reason I ask is that
I would rather just have to enter a password or no password (with RSA
authentication - no passphrase) from within my lan but on the public
internet, I would set up an authentication with password and RSA
public/private key with passphrase and then only allow that from two
laptops.  Is this possible and/or is this overkill?

 

Last but not least, I imagine I can change the port on which sshd listens.
Do I only have to change the relevant line in /etc/services or is there
something else I need to look at?

 

If somebody can point me in the right direction, or suggest/advise the best
way of doing this, I would appreciate it.  I'll then go figure out the
details.

 

Thanks,

Michael

 

 




More information about the redhat-list mailing list