Kill user session if from unknown source

Question

I would like to kill ssh connections to my server if they are from a particular 'office'

Any ideas how I would do this without using ip-tables?

Cheers

Answer 1

You can use what are called "TCP wrappers", the /etc/hosts.allow and /etc/hosts.deny files to restrict access. For example, you can add the line:

sshd: sammy.badguy.net

to /etc/hosts.deny.

You generally don't need to restart networking of services for changes to /etc/hosts.deny to take effect, however, you should test after making any changes, especially if made changes remotely while logged in via SSH.

You can find a more complete guide to controlling SSH access with TCP wrappers here.

You can also read

man hosts.deny