Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to allow anybody in the range to be able to log in with a password or a SSH key, but people outside that range to only be able to log in with a SSH key.

Can this be accomplished without more than one sshd?

I'm on Ubuntu 9.04.

share|improve this question
up vote 7 down vote accepted

This is untested, but setting up something like this at the very end of sshd_config should work:

PasswordAuthentication no
PubkeyAuthentication yes
RSAAuthentication yes

Match Address
  PasswordAuthentication yes

Basically you're globally allowing public key auth, globally disallowing password auth, and then specifically re-allowing password authentication for anyone in the subnet.

Edit: You probably already have the first three lines elsewhere in your config. If you do, they do not need to be added again. However the "Match" block must be at the end of the file.

Also, the RSAAuthentication keyword is specific to SSH v1, which you don't allow, right?

share|improve this answer
hey, your answer worked great, thanks. I just had to add "Address" between "Match" and the IP address. Can you edit it to add that to the directive? – lfaraone Sep 10 '09 at 23:58
Good catch. Done. – Insyte Sep 11 '09 at 22:30
this "Match Address" block is superb. I just used it to enable root logins on! – neoice Jan 10 '10 at 15:25

Yes, I think so. You can use the AllowUser and MatchUser directives in the sshd_config file to set up per-user configuration directives.

share|improve this answer
But that controls access based on username and host without regard to what authentication method they're using. He wants to control which authentication methods are allowed depending on the host. – freiheit Sep 10 '09 at 21:32
I was suggesting that one might be able to add PasswordAuthentication directives under the MatchUser user-specific settings. Haven't tried it, do you know if that would work? I've thus far only used Chroot and force-command settings under MatchUser. – Devin Ceartas Sep 11 '09 at 0:59

I think you can make this work by configuring sshd with PAM and Pubkey auth, and then configure PAM to only allow access from certain subnets. This trickery works because sshd doesn't ask PAM anything about key based auth.

In /etc/ssh/sshd_config (I think these are the defaults anyways on Ubuntu) something like:

PubkeyAuthentication yes
ChallengeResponseAuthentication no
UsePAM yes

In /etc/pam.d/sshd uncomment the pam_access line (I believe on Ubuntu it's present in the right sequence but commented out):

account required

In /etc/security/access.conf:


Note: I have not tested this at all.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.