Linux – Restrict root ssh from all but one IP/hostname

linuxpamssh

I'm wanting to restrict root ssh login coming from all but a single IP address.

I was under the impression that I just had to add this to /etc/pam.d/sshd:

account required pam_access.so

and this to /etc/security/access.conf:

-:root:ALL EXCEPT IPADDRESS

but that doesn't seem to be working.

Best Answer

In /etc/ssh/sshd_config

# Disable Root login
PermitRootLogin no
#
# [ . . . ]
#
# At the end of the file, add:
#
# Allow Root Login via Key from Admin Bastion
Match Address 10.9.8.7
        PermitRootLogin without-password
Related Topic