How to allow only certain users to login to an SSH server from a particular network interface?
- eth0 is "outside", eth1 is "inside".
- user1 is trusted to login from anywhere
- user2 is only allowed to login from "inside"
AllowUsers user1@eth0 because AllowUsers takes a hostname not an interface name.
Other answers on this site suggest something like:
Match address 184.108.40.206/16 # eth0's network AllowUsers user1 Match address 220.127.116.11/16 # eth1's network AllowUsers user1,user2 Match address 0.0.0.0/0 # Match's equivalent of a closing brace?
However if eth0 is using a DHCP server to get its address, then it doesn't know in advance that 18.104.22.168 is the right address to put in sshd_config.
(OpenSSH on Ubuntu 12.04 if that makes a difference)