Restricting SSH Access by IP Address and User Group

When it comes to managing your server, one of the top priorities is making sure only the right people have access. If SSH access were a party, you wouldn’t want random people walking in and grabbing a seat, right? You’d want an exclusive guest list, checking IDs at the door, and maybe even a bouncer or two. Well, that’s what restricting SSH access by IP address and user group does for your server. It lets you decide exactly who can get in and from where, keeping your system secure without making it a hassle for your trusted users.

In this guide, we’ll walk you through the simple steps to add these restrictions, helping you set up SSH access that’s as exclusive as you need it to be. Whether it’s a handful of fixed IPs or only a select group of users, you’ll learn how to get that extra layer of security in place.

Why Limit SSH Access?

Well, think of it this way: Every open path to your server is a potential risk. SSH, or Secure Shell, is already pretty safe with its encryption and secure login, but leaving access open to everyone can invite trouble, especially from automated bots or malicious actors scanning the web for vulnerable servers. By restricting access to specific IP addresses or user groups, you’re putting up a digital “Authorized Personnel Only” sign. It’s an easy, effective way to narrow down who can try to log in, making your server a lot less attractive to would-be attackers.

Step 1: Restricting SSH Access by IP Address

Let’s start by locking down SSH access to certain IP addresses. This is especially handy if you only ever connect from a fixed IP or a few trusted ones (like your home, office, or VPN).

1. Open your SSH configuration file.

Pop open the SSH configuration file with this command:

sudo nano /etc/ssh/sshd_config

2. Edit the configuration.

At the end of the file, add lines to specify which IPs are allowed. Use the AllowUsers directive followed by the usernames and IP addresses:

AllowUsers yourusername@192.168.1.10 anotheruser@203.0.113.5

Alternatively, if you want to allow SSH access from a specific subnet, you can set it like this:

AllowUsers yourusername@192.168.1.*

3. Restart the SSH service.

Save the file and restart SSH to apply the changes:

sudo systemctl restart sshd

Note: Be careful with this one—if you’re on a dynamic IP, you could lock yourself out!

Step 2: Restricting SSH Access by User Group

Sometimes, you want multiple users with different levels of access to your server. Say you have a team, and only the admins need SSH access. In that case, restricting access by user group is perfect.

1. Create a new group for SSH users.

Start by making a group that will control who can log in. Let’s call it sshusers:

sudo groupadd sshusers

2. Add users to the group.

Now, add specific users to this group:

sudo usermod -aG sshusers username1
sudo usermod -aG sshusers username2

3. Update the SSH configuration file.

Edit the sshd_config file again, this time to restrict access based on the group. Add this line at the end:

AllowGroups sshusers

4. Restart the SSH service.

As usual, restart the SSH service:

sudo systemctl restart sshd

Combining IP and User Group Restrictions

If you’re feeling fancy, combine IP and group restrictions for even tighter security. Just make sure you specify both AllowUsers and AllowGroups in sshd_config, and SSH will enforce both.

Quick Tips for Troubleshooting

Tip 1 – Locked out

If you accidentally block yourself, it’s usually possible to log in directly from the server’s console or through a control panel if you have one (like on a VPS or cloud provider).

Tip 2 – Testing Changes

Always keep an extra SSH session open before restarting the service, just in case you need to undo any changes.

Tip 3 – Audit Access List Regularly

It’s good practice to check your IP and group settings every so often to remove outdated entries and keep things current.

Final Thoughts

Taking a few minutes to restrict SSH access by IP and user group can make a big difference in your server’s security. So, why not add that extra layer of protection today? Start with the basics, test it out, and see how it works for your setup. Think of it as a proactive way to keep potential threats at bay—after all, no one can breach a door they can’t reach! So take a few minutes to secure your SSH access, and enjoy that peace of mind knowing you’ve added another layer of protection to your server.

Got questions or want to share your SSH experience? Drop a comment below!