Change the SSH authentication method depending on the IP address

Question

How can I setup my SSH server so that the authentication method depends upon the client IP address?

internal network -> password login enabled
request from WAN -> only passkeys enabled

I would avoid to setup two accounts (internal/external) for each user and rewrite the configuration file accordingly.

Answer 1

Have a look at the man page for sshd_config. If you have a reasonably up-to-date version of OpenSSH you can use Match directives:

Match Address 192.168.0.0/24
  PasswordAuthentication yes

Match Address 10.0.0.0/24
  PasswordAuthentication no

But as ErikA says, just use keyauth anyway and don't let on that you can do this ;-)

Answer 2

Why allow password auth at all?

If it's the same group of users who will be connecting from inside and outside, then they will already have figured out how to get key auth set up.

Honestly, when set up correctly (passphrase-protected private keys, client using ssh-agent), key auth is much easier to use than having to type in a password each time.