IP and User-Based Blocking for SFTP Proxy
IP and user-based blocking lets you allow SFTP proxy access only from an approved network range. You define an allowed subnet for an End User Group. Kron PAM then allows an SFTP connection only when the user belongs to that group and connects from an IP address within the subnet. Kron PAM blocks every other connection during authentication, even when the user enters valid credentials
You define the allowed subnet in Classless Inter-Domain Routing (CIDR) format, for example 10.20.42.0/24. Users can connect through common SFTP clients such as Filezilla,WinScp and MobaXterm.
The message reads Authentication Configuring IP and User-Based Blocking
To restrict SFTP proxy access by user and IP address, follow these steps:
1. Log in to Kron PAM as an administrator.
2. Navigate to User Management > End User Groups, and then select the group that you want to restrict.
3. Open the group settings, and then find the allowedIpSubnets parameter.
4. Enter the allowed network range in CIDR format, for example 10.20.42.0/24.
5. Click Save to apply your changes
After you save, only users in this group who connect from the defined subnet can use the SFTP proxy.
How IP and User-Based Blocking Works
Kron PAM checks both the user and the client IP address at each SFTP connection attempt:
• When the user belongs to the restricted group and connects from an IP address within the allowed subnet, Kron PAM allows the connection.
• When the client IP address is outside the allowed subnet, Kron PAM blocks the connection during authentication, even when the credentials are correct.
• Users who do not belong to the restricted group are not affected by the rule.
For example, if you set the allowed subnet to 10.20.42.0/24, a restricted user who connects from 10.0.8.10 cannot use the SFTP proxy. A user who is not in the restricted group can still connect from the same IP address.
When Kron PAM blocks an SFTP connection because of an IP and user-based rule, it records a descriptive message in the SFTP proxy log file. .
Log file: /pam/sftp/log/Application.log
Kron PAM now records the following message
Error: Authentication failed - Client IP is not in valid range |
|---|
This message confirms that Kron PAM blocked the connection because the client IP address is not within the allowed subnet.
The following example shows the log entries that Kron PAM records when it blocks an SFTP connection from an SFTP client such as MobaXterm, Filezilla, or WinSCP:
