some suggesion on fixing IP issue

[greenhat]

Dear All

I have 3 user in DirectAdmin . All of them want there Direct Admin Panel opens only from there specified 2-3 IPs , Rest no one can log in with any other IP.

Any suggestion about it.

 

[zEitEr]

Hello,

I'd rather say it's not possible... unless you configure iptables to use module string and check logins... and URL.

Iptables man page says:
-----------------------------------------------------------------------------------------------------------
string
This modules matches a given string by using some pattern matching strategy. It requires
a linux kernel >= 2.6.14.

--algo bm|kmp
Select the pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)

--from offset
Set the offset from which it starts looking for any matching. If not passed,
default is 0.

--to offset
Set the offset from which it starts looking for any matching. If not passed,
default is the packet size.

--string pattern
Matches the given pattern. --hex-string pattern Matches the given pattern in hex
notation.
-----------------------------------------------------------------------------------------------------------

So iptables can inspect the content of the packet!!

 

[greenhat]

Ok,, Is there any facilty for doing this in OSSEC or any other HIDS or anything else.

 

[zEitEr]

OK, I've just found a link http://help.directadmin.com/item.php?id=349 it might be helpful.

 

[SeLLeRoNe]

Ive posted this in another thread, try this:

#!/bin/sh

if [ "${username}" = "USERNAME" ]; then

     #repeat the following check on the IP as many times as desired.

     if [ "$caller_ip" = "1.2.3.4" ]; then
         exit 0;
     fi

     #end of ip check

     echo "IP $caller_ip is not allowed to be logged in as an $username";
     exit 1;
fi
exit 0;

Repeat the main if for each user, and for each user repeat the internal if for each ip.

Should work as you ask.

Regards