I have a home server with some SSH accounts that have weak passwords. Since we only used it locally, that's not that big a problem.
Now I want to allow external access from only one account, but still local access from the others. But this doesn't work (because only a subset of options is allowed in matches):
AllowUsers externaluser Match Address 192.168.0.0/24 AllowGroups localusers
What's the best way to emulate this? (or should I just allow the local users external access, too, but without password auth, hoping they keep their private keys private?)