Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I setup my SSH server so that the authentication method depends upon the client IP address?

internal network -> password login enabled
request from WAN -> only passkeys enabled

I would avoid to setup two accounts (internal/external) for each user and rewrite the configuration file accordingly.

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

Have a look at the man page for sshd_config. If you have a reasonably up-to-date version of OpenSSH you can use Match directives:

Match Address 192.168.0.0/24
  PasswordAuthentication yes

Match Address 10.0.0.0/24
  PasswordAuthentication no

But as ErikA says, just use keyauth anyway and don't let on that you can do this ;-)

share|improve this answer
    
Very interesting, I was used to apply "Match" only for user-based decisions –  ziu Jan 31 '12 at 18:12
add comment

Why allow password auth at all?

If it's the same group of users who will be connecting from inside and outside, then they will already have figured out how to get key auth set up.

Honestly, when set up correctly (passphrase-protected private keys, client using ssh-agent), key auth is much easier to use than having to type in a password each time.

share|improve this answer
    
It would be easier for me too, but I have received this fancy request and I am checking whether it is doable before starting "war" –  ziu Jan 31 '12 at 16:47
    
With proper user training, good setup documentation, and with the significantly increased security provided by key auth, you should be able to push back against this request fairly easily. –  EEAA Jan 31 '12 at 16:49
    
That's true and it is my final goal. I'll keep this question unaccepted for a while, out of geeky curiosity. –  ziu Jan 31 '12 at 17:27
    
@ErikA: never underestimate the PHB –  Hubert Kario Jan 31 '12 at 19:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.