Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We would like to set up one of your RHEL-servers to allow password based login from our internal network, and disallow the use of passwords for external logins. Any idea how we could achive that without running another daemon? The internal Network is on a different interface, but I don't see how to configure the SSHd to diferenciate between the interfaces.

share|improve this question

2 Answers 2

up vote 11 down vote accepted

You need the 'Match' directive. Something like:

PasswordAuthentication no
Match Address 192.168.0.0/16
   PasswordAuthentication yes

Read sshd_config(5) for details.

That's the answer to your question. However, generally speaking keys are probably a better approaches than passwords for many reasons, not least, the ability to use ssh-agent(1). You might want to consider carefully whether you really have a valid reason for permitting passwords at all.

share|improve this answer
    
This is a better answer than mine, I just learned something! Looks like Match would work. –  Phil Hollenback Jan 19 '11 at 16:27
    
This would work - if RedHat Enterprise Linux had a current Version of OpenSSH available. The version 4.3p2 that is installed by default does not support the Match Keyword. So now I need to find out, where to get the right RPM. –  Flyhard Jan 21 '11 at 9:01

I don't think there's a way to do this with just one ssh server. I think the bigger question is why do you want to do this? Is there some procedural reason you can't just disallow passwords and use public keys all the time?

One way you could do this is to run two sshd instances on the server with separate configs and on different ports. Use iptables to allow access to one server on one interface and one on the other, Set one to allow passwords only and one to allow public key only.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.