IP and User-Based Blocking for SSH Proxy
IP and user-based blocking lets you allow SSH proxy access only from an approved network range. You define an allowed subnet for an End User Group. Kron PAM then allows an SSH connection only when the user belongs to that group and connects from an IP address within the subnet. Kron PAM blocks every other connection during authentication, even when the user enters valid credentials.
You define the allowed subnet in Classless Inter-Domain Routing (CIDR) format, for example 10.20.42.0/24. Users can connect through common SSH clients such as PuTTY and MobaXterm.
Configuring IP and User-Based Blocking
To restrict SSH proxy access by user and IP address, follow these steps:
1. Navigate to User Management > End User Groups, and then select the group that you want to restrict.
2. Open the Group Settings, and then add the allowedIpSubnets parameter.
3. Enter the allowed network range in CIDR format, for example 10.20.42.0/24.
4. Click Save to apply your changes.
After you save, only users in this group who connect from the defined subnet can use the SSH proxy.
How IP and User-Based Blocking Works
Kron PAM checks both the user and the client IP address at each SSH connection attempt:
• When the user belongs to the restricted group and connects from an IP address within the allowed subnet, Kron PAM allows the connection.
• When the client IP address is outside the allowed subnet, Kron PAM blocks the connection during authentication, even when the credentials are correct.
• Users who do not belong to the restricted group are not affected by the rule.
For example, if you set the allowed subnet to 10.20.42.0/24, a restricted user who connects from 10.0.8.10 cannot use the SSH proxy. A user who is not in the restricted group can still connect from the same IP address.
When the client IP address is outside the allowed subnet, Kron PAM also blocks access to the Kron PAM graphical user interface (GUI).
When Kron PAM blocks an SSH connection because of an IP and user-based rule, it records a descriptive message in the SSH proxy log file.
Log file: /pam/ssh/log/Application.log
Kron PAM now records the following message:
Error: Authentication failed - Client IP is not in valid range
This message confirms that Kron PAM blocked the connection because the client IP address is not within the allowed subnet.
The following example shows the log entries that Kron PAM records when it blocks an SSH connection from an SSH client such as MobaXterm or PuTTY.
