2

How can I setup my SSH server so that the authentication method depends upon the client IP address?

internal network -> password login enabled
request from WAN -> only passkeys enabled

I would avoid to setup two accounts (internal/external) for each user and rewrite the configuration file accordingly.

2 Answers 2

6

Have a look at the man page for sshd_config. If you have a reasonably up-to-date version of OpenSSH you can use Match directives:

Match Address 192.168.0.0/24
  PasswordAuthentication yes

Match Address 10.0.0.0/24
  PasswordAuthentication no

But as ErikA says, just use keyauth anyway and don't let on that you can do this ;-)

1
  • 1
    Very interesting, I was used to apply "Match" only for user-based decisions
    – ziu
    Jan 31, 2012 at 18:12
6

Why allow password auth at all?

If it's the same group of users who will be connecting from inside and outside, then they will already have figured out how to get key auth set up.

Honestly, when set up correctly (passphrase-protected private keys, client using ssh-agent), key auth is much easier to use than having to type in a password each time.

4
  • It would be easier for me too, but I have received this fancy request and I am checking whether it is doable before starting "war"
    – ziu
    Jan 31, 2012 at 16:47
  • With proper user training, good setup documentation, and with the significantly increased security provided by key auth, you should be able to push back against this request fairly easily.
    – EEAA
    Jan 31, 2012 at 16:49
  • That's true and it is my final goal. I'll keep this question unaccepted for a while, out of geeky curiosity.
    – ziu
    Jan 31, 2012 at 17:27
  • @ErikA: never underestimate the PHB Jan 31, 2012 at 19:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .