Only allow ssh connections to a specific domain

Solution 1:

Since SSH doesn't know something like the Host header in HTTP/1.1, you cannot deny a specific user to login to your server. The SSH daemon can't know which domain originally resolved to the IP address it is listening on.

You could only get another IP address, set it as A resource record for subdomain.example.com and allow the user only to login on that specific IP address.

Solution 2:

I believe you can use the hosts.allow and hosts.deny files to limit access to sshd.

Add the following line to /etc/hosts.deny:

sshd: ALL

And add the following to /etc/hosts.allow:

sshd: xxx.domain1.com

Additionally, you can use denyhosts to further protect sshd from unwanted access.