Topic: SSH Access (again...)

[CG]

Hello all...

I do apologise for posing about this once again, but I am still looking for some sort of solution.

My situation is that I only want to allow ssh access to my SME5.6 server from one IP outside our network.

I have had a look at the /etc/hosts.allow file and on a normal disty its pretty straight forward, BUT, how would one change the
/etc/e-smith/templates/etc/hosts.allow/sshd file to reflect the desired changes?

Once again, any help or advice would be much appreciated.

Regs,

CG

[Curly]

I've just fixed this (e-smith 5.1.2, so not completely the same) bij making a custom template for 45AllowSSH.  Copied the file 45AllowSSH from /etc/e-smith/templates/etc/rc.d/init.d/masq to /etc/e-smith/templates-custom/etc/rc.d/init.d/masq and changed the following:

{
     local %services = ( sshd => $sshd );

    my $status = db_get_prop(%services, 'sshd', 'status') || "disabled";

    my $access = db_get_prop(%services, 'sshd', 'access') || "private";

    if ( ($status eq 'enabled' ) and ($access eq 'public') )
    {
        $OUT .= <<'HERE';
# original line accepts all addresses
# /sbin/ipchains --append input -p tcp -s 0/0 -d $OUTERNET 22 -j ACCEPT

#
# Allow only access from:
# local network 192.168.0.0/255.255.255.0
# 123.234.123.234 / 123.234.123.235
# 124.15. en 125.16. with subnet 255.255.0.0

    /sbin/ipchains --append input -p tcp -s 192.168.0.0/255.255.255.0 -d $OUTERNET 22 -j ACCEPT
    /sbin/ipchains --append input -p tcp -s 123.234.123.234/255.255.255.255 -d $OUTERNET 22 -j ACCEPT
    /sbin/ipchains --append input -p tcp -s 123.234.123.235/255.255.255.255 -d $OUTERNET 22 -j ACCEPT
    /sbin/ipchains --append input -p tcp -s 124.15.0.0/255.255.0.0 -d $OUTERNET 22 -j ACCEPT
    /sbin/ipchains --append input -p tcp -s 125.16.0.0/255.255.0.0 -d $OUTERNET 22 -j ACCEPT
    /sbin/ipchains --append output ! -y -p tcp -d 0/0 -s $OUTERNET 22 -j ACCEPT
HERE
    }
}


Of course, your script is not exactly the same, but the idea should be clear. The firewall keeps all communication from 'wrong' ip-addresses away.

[Curly]

Oops, forgot the activating part:

expand template:

/sbin/e-smith/expand-template /etc/rc.d/init.d/masq

restart masquerading:

/etc/rc.d/init.d/masq restart