I've read how it is possible to disable password authentication on an Ubuntu server. However, is it possible to disable this for remote users only?

I'm afraid that, if I enable this both locally and remotely (as designed), I will ultimately lose the key and lock myself out (over time). If I were able to disable password authentication for remote users only, losing the key wouldn't be so tragic; I could simply go to the LAN and login with a password and create a new key.


From the sshd_config(5) manpage:

 Match   Introduces a conditional block.  If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another
         Match line or the end of the file.

         The arguments to Match are one or more criteria-pattern pairs.  The available criteria are User, Group, Host, LocalAddress, LocalPort, and Address.  The match patterns may consist of single entries or comma-
         separated lists and may use the wildcard and negation operators described in the PATTERNS section of ssh_config(5).

         The patterns in an Address criteria may additionally contain addresses to match in CIDR address/masklen format, e.g. “” or “3ffe:ffff::/32”.  Note that the mask length provided must be consistent
         with the address - it is an error to specify a mask length that is too long for the address or one with bits set in this host portion of the address.  For example, “” and “” respectively.

This means that, assuming to be your LAN, you can have PasswordAuthentication disabled in the main configuration and a Match block like this:

    PasswordAuthentication No
Match Address
    PasswordAuthentication Yes
| improve this answer | |

You can put all remote users into a local (additional) group ex. 'remoteusr' and disallow login with password in 'sshd_config'

Match Group remoteusr
      PasswordAuthentication no
| improve this answer | |
  • I agree that this is an additional layer of security, but it doesn't seem like this would prevent a malicious remote user from getting a password authentication prompt (while attempting usernames and passwords not belonging to the Match Group you've suggested). – LonnieBest Sep 28 '13 at 6:36

An option I've seen used before is to run two instances of sshd reading from separate config files. Your default one listens for normal SSH traffic, configured as securely as you want.

The second instance is your "back door", which listens only on a separate port or separate IP, perhaps with appropriate firewall rules to prevent access from outside the network. It's configured differently; perhaps allowing password auth, perhaps allowing access to accounts that are disallowed in the primary, etc.

| improve this answer | |
  • I didn't think that. Thanks for sharing this idea. – LonnieBest Sep 28 '13 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.