3

I'm using libpam-google-authenticator for two step SSH authentication which is great and adds another level of security to my server. My question: Is it possible to disable this for certain addresses. I.e. when I connect from my development rig (static ip) or from the servers localhost.

This would be great as I could have the security of two step authentication for access over my servers internet connection but keep the easy login of username and passwords on trusted hosts.

Improve this question

1 Answer 1

Reset to default
4

You can setup key based authentication for the local/trusted hosts and everywhere else go w/ two factor google-authenticator.

I use google-authenticator module as well for all ssh logins from external hosts. However, for trusted, local hosts, I setup key based authentication which bypasses google authentication so it is much easier to login... not to mention, all automated scripts (using rsync, scp etc) on local hosts works w/ out interactive verification code.

To setup specific hosts to use key based authentication, first, append your public key to ~/.ssh/authorized_keys on your remote sshd server and add the following to your sshd_config (assuming your local trusted hosts are in 192.168.1.0) and restart sshd.

Match Address 192.168.1.0/24
    PasswordAuthentication no
Improve this answer
2
  • An example of how to limit key based authentication to specific IP ranges would make this answer better.
    – kasperd
    Mar 22, 2015 at 14:37
  • Brilliant! Now on WAN connections it asks for the two step code but on the LAN it uses the authorized key.
    – jamesbaber
    Mar 22, 2015 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.