Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to allow anyone access to SSH with a valid identity key BUT allow only one IP address to have SSH password access.

How do I do this?

(I'm running on Centos 5.5)

share|improve this question
up vote 2 down vote accepted

You can easily use the Match statement (see sshd_config(5)) to distinguish between clients and allow exactly one client (e. g. identified by its IP address) to log in with its password rather than having an SSH key.

share|improve this answer
I only want to allow 1 IP to use SSH password ... but I want that IP (and any other) to be able to use identity key login as well. Can I do this with a Match statement? – Owen Aug 10 '10 at 22:19
Yes, that's also possible. The man page sshd_config(8) mentions explicitly which directives you can use in a Match block. But be aware to put the Match directive and the following directives at the end of your sshd_config file. – joschi Aug 11 '10 at 5:55

Modify pam to do this. I never try this.

share|improve this answer
Go the PAM route. – Jamie Aug 10 '10 at 18:06
Don't! It's a trap! ;) – joschi Aug 10 '10 at 18:08

You could run 2 sshd's

1 - run normally from init, key authentication only (set in sshd_config)

2 - run from xinetd ( listening on a different port (eg 2222) with a separate sshd_config etc and that port is configured with your local firewall (iptables / whatever) to only allow access from the IP you want.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.