Restrict IP ranges for ssh

[jucestain]

This may be tangentially related to my previous post, but I am trying to restrict the ranges of IPs which can connect to my NAS. I have set:

cat /etc/hosts.allow
...
sshd : 10.41.411. 129.69. 160.149. 128. : allow

To allow these ranges and it actually worked well. But, I recently rebooted my NAS after an update and the /etc/hosts.allow file got "refreshed". Is there an option in the GUI or a different way to allow this to persist through reboot? Also, I have already set up key based authentication but I still would like to restrict IP ranges.

 

[Vito Reiter]

Try Services > SSH > Options, Go into the Advanced Mode or Options at the bottom. Try to put your code into the extra options box and see if it works as expected. I'm not positive it will work, but it's worth a shot.

 

[Spearfoot]

This may be tangentially related to my previous post, but I am trying to restrict the ranges of IPs which can connect to my NAS. I have set:

cat /etc/hosts.allow
...
sshd : 10.41.411. 129.69. 160.149. 128. : allow

To allow these ranges and it actually worked well. But, I recently rebooted my NAS after an update and the /etc/hosts.allow file got "refreshed". Is there an option in the GUI or a different way to allow this to persist through reboot? Also, I have already set up key based authentication but I still would like to restrict IP ranges.

You're tinkering with OS files on FreeNAS, which is officially verboten! :D

That said... you might have better luck with a postinit script that creates the /etc/hosts.allow file with the settings you want. I do something very similar to create a swap file and modify /etc/fstab at bootup:

Code:

#!/bin/sh

logfile=/mnt/tank/sysadmin/logs/setup-swap.log
ourswapfile="/usr/swap0"

echo "$(date): $0 started" | tee ${logfile}

if [ -f ${ourswapfile} ]; then
  echo "Swap file ${ourswapfile} exists" | tee -a ${logfile}
else
  dd if=/dev/zero of=${ourswapfile} bs=1m count=8192
  chmod 0600 ${ourswapfile}
  echo "Created swap file ${ourswapfile}" | tee -a ${logfile}
fi

echo "md99 none swap sw,file=${ourswapfile},late 0 0" >> /etc/fstab
swapon -aL | tee -a ${logfile}

echo "=== Contents of /etc/fstab ===" | tee -a ${logfile}
cat /etc/fstab | tee -a ${logfile}
echo "==============================" | tee -a ${logfile}

echo "$(date): $0 completed" | tee -a ${logfile}

You might try something like this:

Code:

#!/bin/sh
echo "sshd : 10.41.411. 129.69. 160.149. 128. : allow" > /etc/hosts.allow

You may have to chmod the file appropriately... I dunno.

Good luck!