up vote 1 down vote favorite
2
share [g+] share [fb]

I want to allow anyone access to SSH with a valid identity key BUT allow only one IP address to have SSH password access.

How do I do this?

(I'm running on Centos 5.5)

link|improve this question
83% accept rate
feedback

3 Answers

up vote 2 down vote accepted

You can easily use the Match statement (see sshd_config(5)) to distinguish between clients and allow exactly one client (e. g. identified by its IP address) to log in with its password rather than having an SSH key.

link|improve this answer
I only want to allow 1 IP to use SSH password ... but I want that IP (and any other) to be able to use identity key login as well. Can I do this with a Match statement? – Owen Aug 10 '10 at 22:19
Yes, that's also possible. The man page sshd_config(8) mentions explicitly which directives you can use in a Match block. But be aware to put the Match directive and the following directives at the end of your sshd_config file. – joschi Aug 11 '10 at 5:55
feedback
up vote 3 down vote

http://www.softpanorama.org/Commercial_linuxes/Security/linux_pam.shtml#News

Modify pam to do this. I never try this.

link|improve this answer
Go the PAM route. – Jamie Aug 10 '10 at 18:06
Don't! It's a trap! ;) – joschi Aug 10 '10 at 18:08
feedback
up vote 0 down vote

You could run 2 sshd's

1 - run normally from init, key authentication only (set in sshd_config)

2 - run from xinetd (http://www.itech7.com/Linux/How-to-configure-SSHD-on-Xinetd) listening on a different port (eg 2222) with a separate sshd_config etc and that port is configured with your local firewall (iptables / whatever) to only allow access from the IP you want.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.