132

I'd like to allow SSH password authentication from only a certain subnet. I see the option to disallow it globally in /etc/ssh/sshd_config:

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

Is there a way to apply this configuration to a select range of IP addresses?

Improve this question

2 Answers 2

Reset to default
196

Use a Match block at the end of /etc/ssh/sshd_config:

# Global settings
…
PasswordAuthentication no
…

# Settings that override the global settings for matching IP addresses only
Match address 192.0.2.0/24
    PasswordAuthentication yes

Then tell the sshd service to reload its configuration:

service ssh reload
Improve this answer
9
  • 1
    I tried this (with 192.168.0.0/16 instead) and when I restarted the ssh service I got locked out. SSH refused any connections. Any idea why this could be?
    – Michael Waterfall
    Feb 26, 2013 at 11:24
  • 3
    @MichaelWaterfall It's impossible to tell with so little information. Make sure to keep a shell running until you've validated the new configuration. Restarting the ssh service doesn't affect active connections.
    – Gilles 'SO- stop being evil'
    Feb 26, 2013 at 12:23
  • 33
    The likely issue is that you put the Match block someplace in the middle of your sshd_config. Match lines affect every following line until the next Match line, so they should be at the end of the file.
    – Ken Simon
    May 16, 2013 at 3:11
  • 6
    Despite the indentation in the answer, sshd_config is not Python ;)
    – Nick T
    Feb 7, 2017 at 17:25
  • 1
    @frepie The Match block extends until the next Match directive or until the end of the file. That's why you have to put it at the end.
    – Gilles 'SO- stop being evil'
    Dec 19, 2017 at 15:27
9

you can add:

AllowUsers [email protected].*.*, [email protected].*.*

this changes default behaviour, really deny all other users from all hosts. Match block available on OpenSsh version 5.1 and above.

Improve this answer
2
  • call I allow a group instead of a single user
    – Lamour
    Jul 6, 2016 at 21:16
  • @Lamar From man sshd_config, it looks like AllowGroups works the same as AllowUsers, but AllowUsers seems to take precedence over AllowGroups.
    – conradkleinespel
    Feb 16, 2018 at 17:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .