24

I know it's possible to have sshd listen on multiple ports by using multiple Port directives. Is it possible to independently adjust the settings per port, however? In particular, is it possible to have one port allow password authentication, but another port disallow it?

2
  • 1
    By the way: the reason I'm doing this is that I want to allow passwords on my LAN, but not from the WAN. My WAN firewall only allows connecting to the more restrictive port. Oct 14, 2014 at 19:13
  • 1
    See also restriction by IP address(es) if you prefer to use the standard port number.
    – ændrük
    Oct 15, 2014 at 13:50

2 Answers 2

34

This can be accomplished with the Match directive.

In /etc/sshd_config, declare multiple ports:

Port 22
Port 2222

Then, at the very end of the file, add the following:

Match LocalPort 2222
PasswordAuthentication no

All settings will be shared between the ports, except password authentication will be disabled on port 2222.

1
  • Too bad Match doesn't work with AllowUsers. For anyone that needs to restrict users for a specific port, you're likely stuck with running multiple sshd instances.
    – Bob
    Oct 15, 2014 at 12:12
0

A single sshd process, I don't believe so, but it should be fairly easy to set up a second configuration file and run two sshd listeners, one on the password ports and the other on the non-password ports.

1
  • 4
    I found that there actually is a way to do this with a single instance of sshd. See the answer I posted. Thanks anyway. Oct 14, 2014 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .