http://bugzilla.mindrot.org/show_bug.cgi?id=995
Summary: PermitRootLogin by IP address block specification
Product: Portable OpenSSH
Version: 3.6.1p2
Platform: All
OS/Version: All
Status: NEW
Severity: enhancement
Priority: P3
Component: sshd
AssignedTo: openssh-bugs@mindrot.org
ReportedBy: dts@senie.com
In looking at the options for PermitRootLogin, we find that none properly
address our needs. We use root login with password between servers in a data
center. All of these machines are firewalled. We prefer to leave root login
permitted for various infrequent operations (file copies, etc.) but do not want
to leave keys on the machine to allow such commands at will (concerns that if
one machine is compromised, we would have all machines compromised).
So, we'd like to suggest a mechanism that would permit us to specify one or more
CIDR blocks as places from which root login is permitted. That way, we can
connect into the data center, and then connect among machines as desired, with
fewer issues.
Please consider this an enhancement request. Were it not for the present
pounding our machines take from people trying to break in by guessing passwords,
we probably would not even be asking. As a precaution due to the attacks, we
have disabled root login entirely, but this is interfering with some of our
normal workflow.
I'd be happy to answer any questions.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
Summary: PermitRootLogin by IP address block specification
Product: Portable OpenSSH
Version: 3.6.1p2
Platform: All
OS/Version: All
Status: NEW
Severity: enhancement
Priority: P3
Component: sshd
AssignedTo: openssh-bugs@mindrot.org
ReportedBy: dts@senie.com
In looking at the options for PermitRootLogin, we find that none properly
address our needs. We use root login with password between servers in a data
center. All of these machines are firewalled. We prefer to leave root login
permitted for various infrequent operations (file copies, etc.) but do not want
to leave keys on the machine to allow such commands at will (concerns that if
one machine is compromised, we would have all machines compromised).
So, we'd like to suggest a mechanism that would permit us to specify one or more
CIDR blocks as places from which root login is permitted. That way, we can
connect into the data center, and then connect among machines as desired, with
fewer issues.
Please consider this an enhancement request. Were it not for the present
pounding our machines take from people trying to break in by guessing passwords,
we probably would not even be asking. As a precaution due to the attacks, we
have disabled root login entirely, but this is interfering with some of our
normal workflow.
I'd be happy to answer any questions.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.