Your sshd is probably configured with tcp wrappers (My RHEL4/5 were). If you only log in from a known set of static IPs, you could add in /etc/hosts.deny:

Your sshd is probably configured with tcp wrappers (My RHEL4/5 were). If you only log in from a known set of static IPs, you could add in /etc/hosts.deny: sshd: IP1 IP2 .domain.com The .domain.com allows any IP which reverses to .domain.com. I ran: grep Accepted /var/log/secure*|grep ssh2|perl -lne '/for (\S+) from (\S+)/ && print "$1 $2"'|sort -u To find all IPs/users that logged in. This may give you trouble if you SSH from e.g. some mobile connection or from random wifis around the world.