Hi folks,

I want to restrict root access via ssh to certain (internal) hosts.

That is what pam_access.so is for, I thought, so I configured:

in /etc/security/access.conf I added (nothing in there before): + : root : 192.168.123.0/24 10.72.0.0/16 - : root : ALL

in /etc/pam.d/ssh I added at the end: account required pam_access.so

Then I restarted the ssh server.

Basically, this kinda works. Cron suddenly had no right to do it's job, so I had to add + : root : LOCAL to /etc/security/access.conf

But there still is no restriction on ssh logins by root - I can still login from anywhere.

Next I tried putting it in one line in /etc/security/access.conf: - : root : ALL EXCEPT LOCAL 192.168.123.0/24 10.72.0.0/16 That did not change anything, still I can log in via ssh.

I am stuck. According to documentation and the examples on the net this should be the right syntax. And, by the way, in my /etc/ssh/ sshd_config I have "UsePAM yes".

Any help or hint is appreciated.

Dirk