---
title: How to Restrict SSH Access to Specific IPs Using hosts.allow and hosts.deny
description: "Restricting SSH access to specific IPs is a fundamental security practice that limits who can access your server, helping reduce the risk of unauthorized access. ## Prerequisites - Sudo SSH access to the server; either with user root or sudo…"
url: "https://truehost.com/support/knowledge-base/how-to-restrict-ssh-access-to-specific-ips-using-hosts-allow-and-hosts-deny/"
updated: "2024-10-31"
category: Cloud servers in Kenya
---

# How to Restrict SSH Access to Specific IPs Using hosts.allow and hosts.deny

Restricting SSH access to specific IPs is a fundamental security practice that limits who can access your server, helping reduce the risk of unauthorized access.

## Prerequisites

- Sudo SSH access to the server; either with user root or sudo user.

On Linux systems, you can use the `hosts.allow` and `hosts.deny` files to control access to SSH and other services.

## Understanding `hosts.allow` and `hosts.deny`

The `hosts.allow` and `hosts.deny` files are part of TCP Wrappers, a mechanism for filtering incoming connections based on predefined rules. You can specify which IP addresses are allowed or denied access to specific services by configuring these files.

- **`/etc/hosts.allow`**: Specifies which IP addresses can access certain services.
- **`/etc/hosts.deny`**: Denies access from IP addresses to services not allowed in `hosts.allow`.

**Note:** TCP Wrappers may not be enabled by default on all systems, so verify compatibility on your Linux distribution.

**Step 1:** SSH to your server. You can refer to **[this guide.](https://truehost.com/support/knowledge-base/how-to-access-a-server-via-ssh-terminal/)**

**Step 2: Open `hosts.allow` and `hosts.deny`**

- To start restricting SSH access, edit the configuration files. You can use vi or nano based on your preference.

```
sudo vi /etc/hosts.allow
sudo vi /etc/hosts.deny
```

**Configure `hosts.allow`**

- Access the `/etc/hosts.allow` file

```
sudo vi /etc/hosts.allow
```

- Specify the allowed IP addresses. For SSH, add the following line, replacing `192.168.1.100` with the IP address you wish to allow:

```
sshd: 192.168.1.100
```

![](https://truehost.com/support/wp-content/uploads/2024/10/image-685.png)

- You can allow multiple IPs by separating them with spaces:

```
sshd: 192.168.1.100 192.168.1.101 203.0.113.50
```

- Alternatively, to allow an entire subnet, use CIDR notation or wildcard symbols:

```
sshd: 192.168.1.0/24
```

**Configure `hosts.deny`**

Access `/etc/hosts.deny`,

```
sudo vi /etc/hosts.deny
```

deny all other IP addresses by adding this line:

```
sshd: ALL
```

This line blocks all SSH access by default, except for those IPs explicitly allowed in `hosts.allow`.

![](https://truehost.com/support/wp-content/uploads/2024/10/image-686-1024x480.png)

**Step 3: Verify TCP Wrappers Support (optional)**

On some distributions, you may need to verify that TCP Wrappers is installed and supported. Install the necessary package if it’s not present:

```
# On RHEL-based systems
sudo yum install tcp_wrappers

# On Debian-based systems
sudo apt install tcpd
```

![](https://truehost.com/support/wp-content/uploads/2024/10/image-687-1024x506.png)

**Step 4: Test the Configuration**

- Once configured, test the setup by attempting to SSH from allowed and disallowed IP addresses to ensure the rules work as expected.

Below image shows successful connection from an allowed IP/network

![](https://truehost.com/support/wp-content/uploads/2024/10/image-688-1024x612.png)

Below image shows unsuccessful connection from a denied IP/network

![](https://truehost.com/support/wp-content/uploads/2024/10/image-689-1024x257.png)

**Example Configuration**

Here's an example of how the files might look:

#### `/etc/hosts.allow`

```
sshd: 192.168.1.100 192.168.1.101 203.0.113.50
```

#### `/etc/hosts.deny`

```
sshd: ALL
```

## Author's final word

Using `hosts.allow` and `hosts.deny` is an effective way to restrict SSH access to specific IPs on Linux servers. By configuring these files, you can create a robust layer of security for your server’s SSH access, helping to protect your system from unauthorized login attempts.