Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I setup my SSH server so that the authentication method depends upon the client IP address?

internal network -> password login enabled
request from WAN -> only passkeys enabled

I would avoid to setup two accounts (internal/external) for each user and rewrite the configuration file accordingly.

share|improve this question
up vote 6 down vote accepted

Have a look at the man page for sshd_config. If you have a reasonably up-to-date version of OpenSSH you can use Match directives:

Match Address
  PasswordAuthentication yes

Match Address
  PasswordAuthentication no

But as ErikA says, just use keyauth anyway and don't let on that you can do this ;-)

share|improve this answer
Very interesting, I was used to apply "Match" only for user-based decisions – ziu Jan 31 '12 at 18:12

Why allow password auth at all?

If it's the same group of users who will be connecting from inside and outside, then they will already have figured out how to get key auth set up.

Honestly, when set up correctly (passphrase-protected private keys, client using ssh-agent), key auth is much easier to use than having to type in a password each time.

share|improve this answer
It would be easier for me too, but I have received this fancy request and I am checking whether it is doable before starting "war" – ziu Jan 31 '12 at 16:47
With proper user training, good setup documentation, and with the significantly increased security provided by key auth, you should be able to push back against this request fairly easily. – EEAA Jan 31 '12 at 16:49
That's true and it is my final goal. I'll keep this question unaccepted for a while, out of geeky curiosity. – ziu Jan 31 '12 at 17:27
@ErikA: never underestimate the PHB – Hubert Kario Jan 31 '12 at 19:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.