Restrict SSH access to specific IP addresses

[hcj-online]

Hi there!

I want to make SSH accessible only from certain IP addresses. Normally I would just set up an iptables rule to do this. However, the cloudron documentation suggests not to add your own iptables rules. What is the best way to implement this restriction without having a dedicated firewall in front of the cloudron machine?

Thank you!

[murgero]

Where are you hosting? As far as I know Cloudron manages it's own firewall so making rules make break something but the docs do have something that may or may not help: https://docs.cloudron.io/networking/#firewall

[p44]

@hcj-online If you use Hetzner VPS, you can youse their firewall. Is very easy to configure.

[hcj-online]

Thanks for the feedback, but there is no firewall available in front of this machine (as it would be available when using some cloud providers like Hetzner). I am aware of the Cloudron firewall documentation, but it only provides information on blocking specific IPs. However, I only want to allow a specific IP for SSH.

After some research, is it okay to use hosts.allow and hosts.deny in conjunction with Cloudron?

[necrevistonnezr]

I have modified the Match Address parameter in the SSH daemon configuration pursuant to this: https://unix.stackexchange.com/questions/406245/limit-ssh-access-to-specific-clients-by-ip-address

[girish]

Interesting. So, from @necrevistonnezr's like the hosts.allow/hosts.deny may not work in the future. "Note: this might not be an option on modern distributions, as support for tcpwrappers was removed from OpenSSH 6.7"