Assume UserA is allowed to log in by SSH to a server from public networks as well as from within private ones.

Is there any option to restrict password-enabled logins to the private networks while enforcing public key authentication for the rest of the world?

What I have so far in my config

AllowUsers root@ root@ usera

How can I enable usera to log in from usera@10.0.0/24 by public key or password, and enforce pubic key login for usera from any other network?

Does something imilar to the following work? What is the exact notation syntax?

# no password login from the public
PasswordAuthentication no
ChallengeResponseAuthentication no

# allow password login from private network
Match Users usera@10.0.0/24 root@10.0.0/24
   PasswordAuthentication yes

Thanks for any enlightenment.

PS: Reason for this setup is to enable password-login from within the internal network as a measure of last resort if anything else fails.

| improve this question | | | | |

Your configuration is close. I think what you want is

PubkeyAuthentication yes
PasswordAuthentication yes

AuthenticationMethods publickey

Match Address
AuthenticationMethods publickey password

You can find the details in man sshd_config.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.