I have placed a simple ARM based Debian machine in a DMZ and I would like to set up an SSH proxy into my network. To do this, I would like to require anybody connecting from the WAN to provide a key and a TOTP through OATH. I was able to achieve this by modifying my /etc/pam.d/sshd like so:

# Standard Un*x authentication.
#@include common-auth
# Normally we would `@include common-auth`, but that leaks info with OATH
#auth    required     pam_unix.so nullok_secure

auth    requisite     pam_oath.so usersfile=/etc/users.oath

and my /etc/ssh/sshd_config so:

PasswordAuthentication no
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive:pam
UsePAM yes

This works fine and from the WAN it is only possible to connect through SSH with a valid ssh key and the TOTP together. Password authentication is not possible (as desired) and key without TOTP is also not accepted.

Now I would like to allow access from the LAN with just a key, not requiring the TOTP, or alternatively with the user's password.

I tried to add the following configuration to my /etc/ssh/sshd_config (simplified):

Match Address
    PasswordAuthentication yes
    AuthenticationMethods publickey password

Now when I try to connect from my LAN with the SSH key it works fine, I don't have to enter the TOTP. However when I try to connect with the user's password, it is not accepted and I get a

Failed password for user from 192.168.1.x port 57855 ssh2

in my /var/log/auth.log.

I assume I'm missing something in my sshd_config, but what could it be?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.