Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to get an SSH server running Ubuntu 10.04 to allow password logons only when coming from the local network. For all other users, especially those logging in from the internet via the firewall, I want to force Key based authentication. I googled around and found the following.

Here's what I have changed in /etc/ssh/sshd_config:

PasswordAuthentication yes
Match Address
PasswordAuthentication yes

With that, I log in from another machine that has a 192.168.5. address, but it won't allow me in for lack of a publicKey: Permission denied (publickey).

share|improve this question
up vote 9 down vote accepted

This should do the trick:

PubkeyAuthentication yes
PasswordAuthentication no
Match Address 192.168.5.* PasswordAuthentication yes

The first two lines will enable pubkey authentication by default. The last line will override the other two lines for the matched network (

share|improve this answer
Perfect! Thanks a million. – senorsmile Apr 26 '11 at 21:56
glad to help :) – Marco Ramos Apr 26 '11 at 22:04
Strictly speaking, the third line only overrides the second line -- local network users will still have the option to use pubkey authentication if they so choose, but can also elect to use their password instead. Personally, though, I see absolutely nothing wrong with that -- you're allowing passwords for users on the local network, requiring pubkey for users outside the local network, and as an added bonus allowing local users the option to use the exact same authentication method they use outside. – Kromey Apr 26 '11 at 23:41

The newline after the match condition is significant. This should work:

PasswordAuthentication no
Match Address
PasswordAuthentication yes

EDIT: I'm surprised the other answer worked! It didn't work for me. Well, this way you should be able to use a CIDR netmask.

share|improve this answer
The only thing I edited in my file was to change to 192.168.5* And that got it working. I left the newline which I originally had. – senorsmile Apr 26 '11 at 22:13
It must be something version-dependent - it seems OpenSSH 5.8 at least enforces the newline and allows CIDR netmasks. – Eduardo Ivanec Apr 26 '11 at 22:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.