We've already locked things down pretty well just by requiring that clients authenticate via key exchange, rather than by username and password. When we prohibit password authentication, the bad guys can do brute-force password attacks against us until the cows come home, and it won't do them any good. (Although, in truth, they'll just give up as soon as they find that password authentication has been disabled.) For an extra measure of security, we can also set up a couple of access control mechanisms that will allow only certain users, groups, or client machines to log in to an SSH server. These two mechanisms are as follows:
- Whitelists within the sshd_config file
- TCP Wrappers, via the /etc/hosts.allow and /etc/hosts.deny files
Okay, you're now saying, But what about firewalls? Isn't that a...
