Security CSF Block the SSH Port to All Except the Specific IP's

You can do it in sshd_config.

Locking access to specific IP Address

Code:

# nano /etc/ssh/sshd_config
# AllowUsers root@111.22.3.44

 

Here is the docs from centos. Just be careful not to lock yourself out. Especially if your IP is dynamic.

https://wiki.centos.org/HowTos/Network/SecuringSSH

 

Beside sshd config, you can easily do this with csf.

Basically;

1. Add your 3 static IP in /etc/csf/csf.allow
2. Edit /etc/csf/csf.conf in the TCP_IN section, remove your SSH port.
3. Reload csf.

Or, if you want to allow those static IP access only to your SSH port, in csf.allow add;

tcp|in|d="ssh port"|s="your ip"

example: tcp|in|d=22|s=192.168.0.1​

 

I've read on this topic elsewhere but found no need to implement it. The discussion included establishing a back door using port-knocking. Essentially, you would first set up port-knocking which can be done through CSF (see docs) so the back-door would be created to open the server to either a specific IP/client or to all access not otherwise restricted. Port-knocking is where you hit.knock on selected ports in sequence. The ports you select should be those not being used on the server. CSF/iptables then check the log for access to the ports within the selected amount of time and if the conditions are met, opens up the ports or selected port(s) for access or selected address access.
This obviously opens up a security risk that the exclusive access is aimed at preventing. However, so long as the port-knocking scheme is kept secure, the chances of a breach are generally beyond what is needed by most admins/firms.

 

It's possible to set a dynamic dns?

I have my added in the csf.dyndns file and tried to add the following rule in csf.allow

Code (Text):

tcp|in|d=123|s=domain.duckdns.org

but access was still allowed for all ips

I removed in the csf.conf file the ssh port from the allowed list, it worked, but only that I was also blocked but regained access.

 

Yes I did it
I would like to allow connections on the ssh port only to the dynamic dns that I put in.

 

Ok, now its working
It was not working because I thought it was necessary to add this rule to csf.allow

Code (Text):

tcp|in|d=123|s=domain.duckdns.org