Can I limit the IP access for user?

[kdman]

I mean: can I prevent any access for some user else from a specified IP/IP's ?
I know it can be for the whole server, but I need to set an IP access for each user.

By theway, can I limit the qouta also

[ynilesh]

I am not sure about setting ip per user. but you can set quota on different users. Please follow the link link, http://www.redhat.com/docs/manuals/l...sk-quotas.html

[anomie]

I mean: can I prevent any access for some user else from a specified IP/IP's ?
I know it can be for the whole server, but I need to set an IP access for each user.

For what service?

[kdman]

ynilesh: thanks for quota

anomie: I need to limit IP access for shell user who created by "adduser" command.

[ynilesh]

Question : I need to limit IP access for shell user who created by "adduser" command.

Does it mean you want to restrict local users not to ssh/scp/ftp using your ip address?

If yes there is a workaround if its service base.... i have not tried this anywhere.

1. which {service name} ...
`which sshd`
/usr/sbin/sshd

2. check `ls -al /usr/sbin/sshd`
-rwxr-xr-x 1 root root 368068 2008-04-02 00:33 /usr/sbin/sshd

3. Create group of users whom you want to give access, rest will be denied to access service.
groupadd {groupname} -
ex. `groupadd allowaccess`

4. Give execute permission to this group only.
chgrp allowaccess /usr/sbin/sshd
chmod 750 /usr/sbin/sshd

5. Check if your denied users still can access the service.

Follow the same procedure for other services

[kdman]

Thanks, but that is not what I need.
I offer some shell account and for security reasons, I wan't that account can be access from the client IP only.
I don't wish any hacker can access it even if he got the use and password.

[ynilesh]

Use tcp wrappers which allow/deny access to the ip's, network on service level. You need not to create seperate shell account for that...

Allow sshd service access to only known ip's and network.

[i92guboj]

You all should read on iptables. It can do that and much more. It's not trivial to learn, though.

There are some frontends available, like shorewall, and even graphical ones. But for advanced stuff you'll actually need to learn iptables, since the frontends can never match all the features and flexibility of iptables.

[kdman]

i92guboj : Great advice, Thanks a lot