-2

There are certain domains pointing to my server.

# example.com example.com goes to 20.20.20.20 

I want to deny ssh access using this domain names. I want my server to only accept ssh connections on 20.20.20.20. How can I configure this?

What I have tried

# /etc/ssh/sshd_config UseDNS no 

Example:

If user1 connects to 20.20.20.20 then it should show the login, otherwise it should just drop all connections.

I am on a Debian Distribution.

4
  • 1
    Your question really doesn't make it sound as though you are a professional system administrator. Server Fault only deals with questions from professionals and they expect a certain level of knowledge and understanding from the people who ask there. Are you sure you want this moved there? Also, please don't ask two questions in a single post. I have removed your second question, please ask it separately. Commented Feb 2, 2016 at 11:07
  • 4
    Sshd doesn't know if the connection targeted a name or an IP Commented Feb 2, 2016 at 11:08
  • No, if that's the case. Leave my question here. Commented Feb 2, 2016 at 11:14
  • The UseDNS option on the server makes a reverse DNS lookup of the IP address of the connecting client and then a forward DNS lookup for the resulting name and looks if the result is the IP again. In a time where every dial-up connection has a valid DNS entry and cloud instances with proper DNS records are used for SSH scans, this option is not very helpful anymore. Commented Feb 2, 2016 at 17:12

1 Answer 1

8

You can't. What you ask is impossible in SSH.

It's possible in HTTP, because HTTP/1.1 sends a Host header to tell the server which (virtual) host to connect to. SSH sends no such field. You can see this using the Wireshark network protocol dissector.

If it was possible to do this, obviously it wouldn't provide any additional security.

Please briefly describe why you are trying to perform a given task (I think StackExchange advises this). I wouldn't say you tend to get nasty pile-ons without constructive explanations here. (Um. In light of that: if you're looking at SSH hardening in general, a common & robust solution is to deny password logins and instead use an SSH key stored on your computer).

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.