linkyard/sshd-ipset-whitelist repository overview

⁠sshd-ipset-whitelist

A docker-container with ipset and iptables from kubernetes, inherited by using debian-iptables⁠ as a parent image.

This container can be used to implement ip based whitelisting of the SSH daemon.

By using the country-whitelist published by IPdeny⁠, you agree to their Terms of Service (TOS)⁠ and are familiar with their Copyright notice⁠ and Privacy Policy⁠.

⁠Requirements

• Make sure to run this as a privileged container with host networking.
• Make sure that you are loading IPv6 related kernel-modules before starting this conatiner, see moby#33605⁠

⁠Configuration

The container can be configured with environment variables:

• WHITELISTED_IPV4_IPS: list of IPv4 addresses separated by space that should be whitelisted
• WHITELISTED_IPV4_NETS: list of IPv4 networks separated by space that should be whitelisted
• WHITELISTED_IPV6_IPS: list of IPv6 addresses separated by space that should be whitelisted
• WHITELISTED_IPV6_NETS: list of IPv6 networks separated by space that should be whitelisted
• WHITELISTED_COUNTRIES: list of lowercase ISO 3166-1 alpha-2⁠ country-codes to whitelist; source for the whitelist are hte country IP blocks published by IPdeny⁠

⁠Example

Allow connections from Switzerland, IPv4 private IP addresses and the IPv4 address 8.8.8.8:

docker run \
    --rm \
    --privileged \
    --net=host \
    -e WHITELISTED_COUNTRIES="ch" \
    -e WHITELISTED_IPV4_NETS="10.0.0.0/8 172.16.0.0/12 192.168.0.0/16" \
    -e WHITELISTED_IPV4_IPS="8.8.8.8" \
  linkyard/sshd-ipset-whitelist