3

I'm using libpam-google-authenticator for two step SSH authentication which is great and adds another level of security to my server. My question: Is it possible to disable this for certain addresses. I.e. when I connect from my development rig (static ip) or from the servers localhost.

This would be great as I could have the security of two step authentication for access over my servers internet connection but keep the easy login of username and passwords on trusted hosts.

1 Answer 1

4

You can setup key based authentication for the local/trusted hosts and everywhere else go w/ two factor google-authenticator.

I use google-authenticator module as well for all ssh logins from external hosts. However, for trusted, local hosts, I setup key based authentication which bypasses google authentication so it is much easier to login... not to mention, all automated scripts (using rsync, scp etc) on local hosts works w/ out interactive verification code.

To setup specific hosts to use key based authentication, first, append your public key to ~/.ssh/authorized_keys on your remote sshd server and add the following to your sshd_config (assuming your local trusted hosts are in 192.168.1.0) and restart sshd.

Match Address 192.168.1.0/24
    PasswordAuthentication no
2
  • An example of how to limit key based authentication to specific IP ranges would make this answer better.
    – kasperd
    Mar 22, 2015 at 14:37
  • Brilliant! Now on WAN connections it asks for the two step code but on the LAN it uses the authorized key.
    – jamesbaber
    Mar 22, 2015 at 15:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .