Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to restrict external SSH logins to specific users and allow intranet logins ( to all users. I would appreciate a complete example file for this scenario.

share|improve this question
note that is not a valid private IP class, it should be a B or C class, /8 means a C class (192.x.x.x) – drAlberT Sep 4 '09 at 11:14
Thanks- corrected :) – agsamek Sep 4 '09 at 11:16
@AlberT: A /8 was equivalent to a class A, not a class C -- but for the sake of all that's holy, STOP USING CLASSFUL NOTATION. It's not helpful. – womble Sep 4 '09 at 11:39
up vote 3 down vote accepted

Although not tested, you should be able to use something akin to.

Match Address *,!
    DenyUsers *
    AllowUsers user1 user2 user3

This would go into your sshd_config file.

share|improve this answer

Thank you for your answers. I have also found the following sshd_config syntax at :

AllowUsers john
AllowUsers *@192.168.0.*
share|improve this answer

Use host or public key authentication on the local LAN and then password authentication.

Than configure known hosts or known_keys for every PC in you intranet

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.