up vote 2 down vote favorite
3
share [g+] share [fb]

I would like to restrict external SSH logins to specific users and allow intranet logins (192.168.0.0/24) to all users. I would appreciate a complete example file for this scenario.

link|improve this question
100% accept rate
note that 192.168.0.0/8 is not a valid private IP class, it should be a B or C class, /8 means a C class (192.x.x.x) – AlberT Sep 4 '09 at 11:14
Thanks- corrected :) – agsamek Sep 4 '09 at 11:16
2  
@AlberT: A /8 was equivalent to a class A, not a class C -- but for the sake of all that's holy, STOP USING CLASSFUL NOTATION. It's not helpful. – womble Sep 4 '09 at 11:39
feedback

3 Answers

up vote 3 down vote accepted

Although not tested, you should be able to use something akin to.

Match Address *,!192.168.0.0/24
    DenyUsers *
    AllowUsers user1 user2 user3

This would go into your sshd_config file.

link|improve this answer
feedback
up vote 1 down vote

Thank you for your answers. I have also found the following sshd_config syntax at http://ubuntuforums.org/showthread.php?t=523477 :

AllowUsers john
AllowUsers *@192.168.0.*
link|improve this answer
feedback
up vote 0 down vote

Use host or public key authentication on the local LAN and then password authentication.

Than configure known hosts or known_keys for every PC in you intranet

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.