Restricting SSH Login for specific user to specific network/IP

I have a client running an Oracle RAC environment. Logging in via ssh or anything else as a service account (i.e. oracle)is strictly frowned upon. According to the DBAs, some functions of RAC require direct login as this service account. So, we put in a ‘paper’ policy saying that the account could only login as ssh from within the environment itself. No user was to use the account to login. This has mostly worked, but occasionally we notice a login from the ‘oracle’ account directly from a PC and hit the excuse ‘I forgot’. That’s when I searched for something within sshd or PAM that would allow this login from within the environment, but not from outside. The article I found summed this up very nicely. Thanks NixCraft!

The line I added to the /etc/security/access.conf was:

-: oracle : 192.168.100.

Advertisement