Nerf an SSH login outside expected IP range

authorized_keys

You can make restrictions, but it's clunky and not well-standardized. A command stanza on an authorized key works like the ForceCommand on SSHD Config. It runs the one specified command instead of your requested command or interactive session and then closes the connection. Obviously this is pretty restrictive, and no one would want to make one key per allowlisted command. But SSH sets an environment variable, $SSH_ORIGINAL_COMMAND, to the user's requested command.

If the ForceCommand is a script, it can validate the original command and choose whether to execute it, to execute something else, or to just quit. There doesn't seem to be a standard for performing this validation.

• Some people roll their own case statement with a list of allowed commands. (Some people accidentally do it wrong.)

• Other people have written longer scripts to manage the allowlists (only, sshdo).

from="1.2.3.4/26"                  ssh-rsa AAAAB3N9Q== Normal IP for you@example
from="!1.2.3.4/26",command="sshdo" ssh-rsa AAAAB3N9Q== Weird  IP for you@example

Care should be taken not to allow the user to escalate their own privileges or learn things to formulate a subsequent attack. If they can edit their authorized_keys to remove the hobbling, they can do anything else, right after.

sudoers doesn't work

In the specific case of sudo, one might notice that there are IP and host restrictions mentioned in the documentation for the sudoers file. Those restrictions do not help here. They are for the IP or resolved name of the computer you SSH into, not the place you SSH from. Those restrictions help administrators make a single sudoers policy and push it to a whole network of computers.

posted 7 months ago

CC BY-SA 4.0

7mo ago

Michael‭

231 reputation 1 9 24 36