5

We would like to set up one of your RHEL-servers to allow password based login from our internal network, and disallow the use of passwords for external logins. Any idea how we could achive that without running another daemon? The internal Network is on a different interface, but I don't see how to configure the SSHd to diferenciate between the interfaces.

2 Answers 2

11

You need the 'Match' directive. Something like:

PasswordAuthentication no
Match Address 192.168.0.0/16
   PasswordAuthentication yes

Read sshd_config(5) for details.

That's the answer to your question. However, generally speaking keys are probably a better approaches than passwords for many reasons, not least, the ability to use ssh-agent(1). You might want to consider carefully whether you really have a valid reason for permitting passwords at all.

2
  • This is a better answer than mine, I just learned something! Looks like Match would work. Jan 19, 2011 at 16:27
  • This would work - if RedHat Enterprise Linux had a current Version of OpenSSH available. The version 4.3p2 that is installed by default does not support the Match Keyword. So now I need to find out, where to get the right RPM.
    – Flyhard
    Jan 21, 2011 at 9:01
0

I don't think there's a way to do this with just one ssh server. I think the bigger question is why do you want to do this? Is there some procedural reason you can't just disallow passwords and use public keys all the time?

One way you could do this is to run two sshd instances on the server with separate configs and on different ports. Use iptables to allow access to one server on one interface and one on the other, Set one to allow passwords only and one to allow public key only.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .