Re: Iptables & Remote SSH Sorrows

[Kelly Setzer <Kelly.Setzer@placemark.com>]

On Thu, Apr 10, 2003 at 06:24:33PM +0000, tamato@attbi.com wrote:
> I have configured iptables to allow ssh connections.  However, no one is able 
> to connect unless I add their IP address to the /etc/hosts file.  Since my 
> remote useres are on dynamic IP's - their address changes each time they log in 
> to their internet accounts.  
> 
> Is there a way to configure iptables or another system file that would allow 
> ssh connections from any IP?
> 

In your sshd config file (/etc/sshd/sshd_config on debian), check the
following option.  If it's set to yes, change it to no.

VerifyReverseMapping
  Specifies whether sshd should try to verify the remote host name
  and check that the resolved host name for the remote IP address
  maps back to the very same IP address.  The default is "no".


Also, check /etc/hosts.allow.

You should have:

sshd: ALL

Whereas, you probably have something like:

ALL: PARANOID


Kelly

--
Kelly Setzer, System Administrator/Architect - Placemark Investments
14180 Dallas Pkwy, Suite 200, Dallas, TX 75240
kelly.setzer@placemark.com  http://www.placemark.com
(972)404-8100x41 (work)       (214) 287-3464 (cell)