I know it's possible to have sshd listen on multiple ports by using multiple Port directives. Is it possible to independently adjust the settings per port, however? In particular, is it possible to have one port allow password authentication, but another port disallow it?

  • 1
    By the way: the reason I'm doing this is that I want to allow passwords on my LAN, but not from the WAN. My WAN firewall only allows connecting to the more restrictive port. Oct 14 '14 at 19:13
  • 1
    See also restriction by IP address(es) if you prefer to use the standard port number.
    – ændrük
    Oct 15 '14 at 13:50

This can be accomplished with the Match directive.

In /etc/sshd_config, declare multiple ports:

Port 22
Port 2222

Then, at the very end of the file, add the following:

Match LocalPort 2222
PasswordAuthentication no

All settings will be shared between the ports, except password authentication will be disabled on port 2222.

  • +1 Very interesting Oct 14 '14 at 21:28
  • Too bad Match doesn't work with AllowUsers. For anyone that needs to restrict users for a specific port, you're likely stuck with running multiple sshd instances.
    – Bob
    Oct 15 '14 at 12:12

A single sshd process, I don't believe so, but it should be fairly easy to set up a second configuration file and run two sshd listeners, one on the password ports and the other on the non-password ports.

  • 3
    I found that there actually is a way to do this with a single instance of sshd. See the answer I posted. Thanks anyway. Oct 14 '14 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.