Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to allow anyone access to SSH with a valid identity key BUT allow only one IP address to have SSH password access.

How do I do this?

(I'm running on Centos 5.5)

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

You can easily use the Match statement (see sshd_config(5)) to distinguish between clients and allow exactly one client (e. g. identified by its IP address) to log in with its password rather than having an SSH key.

share|improve this answer
    
I only want to allow 1 IP to use SSH password ... but I want that IP (and any other) to be able to use identity key login as well. Can I do this with a Match statement? –  Owen Aug 10 '10 at 22:19
    
Yes, that's also possible. The man page sshd_config(8) mentions explicitly which directives you can use in a Match block. But be aware to put the Match directive and the following directives at the end of your sshd_config file. –  joschi Aug 11 '10 at 5:55
add comment

http://www.softpanorama.org/Commercial_linuxes/Security/linux_pam.shtml#News

Modify pam to do this. I never try this.

share|improve this answer
    
Go the PAM route. –  Jamie Aug 10 '10 at 18:06
    
Don't! It's a trap! ;) –  joschi Aug 10 '10 at 18:08
add comment

You could run 2 sshd's

1 - run normally from init, key authentication only (set in sshd_config)

2 - run from xinetd (http://www.itech7.com/Linux/How-to-configure-SSHD-on-Xinetd) listening on a different port (eg 2222) with a separate sshd_config etc and that port is configured with your local firewall (iptables / whatever) to only allow access from the IP you want.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.