Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to allow SSH password authentication from only a certain subnet. I see the option to disallow it globally in /etc/ssh/sshd_config:

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

Is there a way to apply this configuration to a select range of IP addresses?

share|improve this question
up vote 62 down vote accepted

Use a Match block at the end of /etc/ssh/sshd_config:

PasswordAuthentication no

Match address
    PasswordAuthentication yes

Then restart sshd service:

service ssh restart
share|improve this answer
I tried this (with instead) and when I restarted the ssh service I got locked out. SSH refused any connections. Any idea why this could be? – Michael Waterfall Feb 26 '13 at 11:24
@MichaelWaterfall It's impossible to tell with so little information. Make sure to keep a shell running until you've validated the new configuration. Restarting the ssh service doesn't affect active connections. – Gilles Feb 26 '13 at 12:23
Hmm, okay I'll experiment and come back with more detail if I continue to have issues. Thanks! – Michael Waterfall Feb 27 '13 at 11:58
The likely issue is that you put the Match block someplace in the middle of your sshd_config. Match lines affect every following line until the next Match line, so they should be at the end of the file. – Ken Simon May 16 '13 at 3:11

you can add:

AllowUsers user@192.168.*.*

this changes default behaviour, really deny all other users from all hosts. Match block avilable on OpenSsh version 5.1 and above.

share|improve this answer
call I allow a group instead of a single user – Lamar Jul 6 at 21:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.