From: Jorge Fábregas (fabregasj@prtc.net)
Date: Wed Apr 13 2005 - 18:51:53 EDT
On Wednesday 13 April 2005 6:31 pm, Stephanie Chung wrote:
> I installed hp-ux ssh to replace telnet and it's
> running fine. My question is how to allow only IP
> range 198.152.*.* to access the SSH and restrict other
> IPs. Since HP-UX ssh is running its own daemon
> (/opt/ssh/sbin/sshd) and not using ‘inetd’, put the
> restriction in ‘inetd.sec’ won’t help. Thanks you for
> your help.
Hi,
You need to run the ssh daemon thru inetd. Do the following:
1- Stop the ssh daemon
2- Make sure it won't start on machine startup by
editing /etc/rc.config.d/sshd
Change SSHD_START=1 to 0
3- Modify /etc/inetd.conf to enable ssh. You must use the "-i" switch in order
to allow it to run thru inetd. I have the following line on my inetd.conf
ssh stream tcp nowait root /usr/sbin/sshd sshd -i
4- Modify /var/adm/inetd.sec accordingly. Something like:
ssh allow 172.16.0.10
etc...
Now you can get the ip filtering benefits provided by inetd.
Of course, this is one scenario. You can still use IPFILTER if you want (and
keep running SSHD stand-alone).
HTH,
Jorge
--
---> Please post QUESTIONS and SUMMARIES only!! <---
To subscribe/unsubscribe to this list, contact majordomo@dutchworks.nl
Name: hpux-admin@dutchworks.nl Owner: owner-hpux-admin@dutchworks.nl
Archives: ftp.dutchworks.nl:/pub/digests/hpux-admin (FTP, browse only)
http://www.dutchworks.nl/htbin/hpsysadmin (Web, browse & search)
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 11:02:47 EDT