I have placed a simple ARM based Debian machine in a DMZ and I would like to set up an SSH proxy into my network.
To do this, I would like to require anybody connecting from the WAN to provide a key and a TOTP through OATH. I was able to achieve this by modifying my
/etc/pam.d/sshd like so:
# Standard Un*x authentication. #@include common-auth # Normally we would `@include common-auth`, but that leaks info with OATH #auth required pam_unix.so nullok_secure # OATH OTP auth requisite pam_oath.so usersfile=/etc/users.oath
PasswordAuthentication no ChallengeResponseAuthentication yes AuthenticationMethods publickey,keyboard-interactive:pam UsePAM yes
This works fine and from the WAN it is only possible to connect through SSH with a valid ssh key and the TOTP together. Password authentication is not possible (as desired) and key without TOTP is also not accepted.
Now I would like to allow access from the LAN with just a key, not requiring the TOTP, or alternatively with the user's password.
I tried to add the following configuration to my
Match Address 192.168.1.0/24 PasswordAuthentication yes AuthenticationMethods publickey password
Now when I try to connect from my LAN with the SSH key it works fine, I don't have to enter the TOTP. However when I try to connect with the user's password, it is not accepted and I get a
Failed password for user from 192.168.1.x port 57855 ssh2
I assume I'm missing something in my
sshd_config, but what could it be?