How to Restrict SSH Access by IP Address on Linux Servers August 19, 2025

This guide helps you keep your Linux server safe by allowing only trusted people to connect to it via SSH. SSH is like a secure door to your server, and you can control who gets through.
We will show you how to allow only specific computers (by their IP address) to log in, and block everyone else. This helps stop hackers from trying to guess your password.

Why does this matter?

• Hackers frequently attempt password guessing (also known as “brute force attacks”).
• Hackers will find it far more difficult to gain access if you only let trusted computers connect.
• No one else can log in, but you can still do so from your laptop, phone, or business computer.

Important safety tips before you start

1. When testing, keep your SSH session open and never close it.
2. Maintain a backup method of accessing your server, such as a console or KVM.
3. Before making any changes, always create a backup of your configuration.
4. Carefully test; if something goes wrong, you can revert to the previous configuration.

Backup command:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

Disable Root Login

The root account is the most powerful on your server. If hackers guess the password, they can take full control. Disabling root login adds a big layer of security.

1. Open the SSH configuration file:

   sudo nano /etc/ssh/sshd_config

2. Find the line that says:

   PermitRootLogin yes

3. Change it to:

   PermitRootLogin no

4. Save the file and restart SSH:

   sudo systemctl restart sshd

   Note: You can still log in as root using sudo after logging in as a regular user.

Change the SSH Default Port

Port 22 is the most targeted port by hackers. Changing it to something like 2222 or 4444 makes your server less visible to automated attacks.

1. In the same file (/etc/ssh/sshd_config), find the line:

   #Port 22

2. Uncomment it (remove the #) and change it to a new port:

   Port 2222

3. Save the file and restart SSH:

   sudo systemctl restart sshd

   Important: Ensure your firewall allows the new port!

4. For example, if you use firewalld, run:

   sudo firewall-cmd --permanent --add-port=2222/tcp
   sudo firewall-cmd --reload

Different methods to restrict SSH Access

Method 1: Use the SSH Settings File (Best for All Systems)
You can alter the SSH settings to only allow certain people from specific computers.

Option A: Allow Only Specific Users from Specific IPs
Let’s say you have a user named John and you only want him to be able to log in from a computer that has the IP address 192.168.1.10, such as your home computer.

Step-by-step:

1. Open the SSH settings file:

   sudo nano /etc/ssh/sshd_config

2. Add this line:

   AllowUsers [email protected]

   This means: “Only user John can log in, and only from the computer at 192.168.1.10.”

3. Save the file and restart SSH:

   sudo systemctl restart sshd

4. Test: Try to log in from your trusted computer; it should work.

 Option B: Use More Advanced Rules (For Complex Needs)
  You can also say:
  “Allow John from 192.168.1.10″
  “But block John from all other computers”

Step-by-step:

1. 1. Open the SSH settings file:

      sudo nano /etc/ssh/sshd_config

   2. Add this:

Match User john Address 192.168.1.10
PasswordAuthentication yes
Match User john Address ! 192.168.1.10
DenyUsers john

1. • This means: “If John tries to log in from 192.168.1.10, allow it.
   • If John tries to log in from any other computer, block it.
2. Save the file and restart SSH:

   sudo systemctl restart sshd

Method 2: Use TCP Wrappers (Only for Older Systems)

Important: This method only works on older Linux systems like CentOS 7. It doesn’t work on modern systems like AlmaLinux 8+, Rocky Linux 8+, or Ubuntu 20.04+.

If you are using a newer system, skip this method.

How It Works:

• You can create a list of allowed IPs.
• Any computer not on the list will be blocked.

Step-by-step:

1. Open the allowed list:

   sudo nano /etc/hosts.allow

2. Add your trusted IP:

   sshd: 192.168.1.10

3. Open the blocked list:

   sudo nano /etc/hosts.deny

4. Add this line:

   sshd: ALL

   This means: “Block everyone except the IPs listed in /etc/hosts.allow.”

5. No restart required; changes take effect immediately.

Method 3: Use a Firewall (Best for Modern Systems)
Modern systems like AlmaLinux 8+, Rocky Linux 8+, and Ubuntu 20.04+ do not support TCP wrappers. So we use a firewall instead.

A firewall controls who can enter, much like a security guard at the door.

For AlmaLinux, CentOS 8+, or Rocky Linux:

1. Open the firewall:

   sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.10" service name="ssh" accept'

   This means: “Allow SSH access only from 192.168.1.10.”

2. Apply the changes:

   sudo firewall-cmd --reload

3. Check if it is working:

   sudo firewall-cmd --list-all

For Ubuntu or Debian:

1. Open the firewall:

   sudo ufw allow from 192.168.1.10 to any port 22

2. Enable the firewall:

   sudo ufw enable

3. Check rules:

   sudo ufw status verbose

How to Test Your Setup?

1. Keep your current SSH session open, don’t close it.
2. Open a new terminal.
3. Try to log in from your trusted computer:

   ssh john@your-server-ip
   

   It should work.

4. Try from a different computer:
   It should fail or time out.

How to Verify Everything Works Well?

1. Check if your rules are active:

   sudo sshd -T | grep -i allow

2. Check firewall rules:

   sudo firewall-cmd --list-all

3. Check logs for failed attempts:

   sudo tail -f /var/log/auth.log

Best Practices for Everyone

1. Use a firewall; it’s the most reliable method on modern systems.
2. Use SSH keys instead of passwords, and use special keys (like a digital ID card).
3. Keep your server updated and install security patches regularly.
4. Document your allowed IPs; write down which computers can connect.
5. Use a VPN; instead of opening SSH to the internet, use a private network.

SSH Access Compatibility by Operating System

• AlmaLinux 8+ / Rocky Linux 8+ / CentOS 8+
  These modern RHEL-based systems work best with SSH settings + firewall rules.
• CentOS 7
  Older OS versions where TCP Wrappers are still supported, along with normal SSH configuration.
• Ubuntu 20.04+ / Debian 10+
  These Debian-based systems commonly use SSH settings + UFW for access management.

Troubleshooting

If you get locked out:

1. Use console access (like a KVM or remote console).
2. Restore the backup:

   sudo cp /etc/ssh/sshd_config.backup /etc/ssh/sshd_config

3. Restart SSH:

   sudo systemctl restart sshd

4. If rules don’t work:
   1. Check for typos in the IP address.
   2. Make sure the service was restarted.
   3. Verify the firewall is not blocking SSH.

In this manner, your server?is much safer?from hackers. It significantly strengthens SSH security and helps safeguard your server against illegal logins.

Want to secure access in Plesk too? Learn How to restrict IP address for administrator access in Plesk