Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'd like to allow SSH password authentication from only a certain subnet. I see the option to disallow it globally in /etc/ssh/sshd_config:

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

Is there a way to apply this configuration to a select range of IP addresses?

share|improve this question

2 Answers 2

up vote 21 down vote accepted

Use a Match block at the end of /etc/ssh/sshd_config:

PasswordAuthentication no

Match address 192.0.2.0/24
    PasswordAuthentication yes

Then restart sshd service:

service ssh restart
share|improve this answer
    
I tried this (with 192.168.0.0/16 instead) and when I restarted the ssh service I got locked out. SSH refused any connections. Any idea why this could be? –  Michael Waterfall Feb 26 '13 at 11:24
    
@MichaelWaterfall It's impossible to tell with so little information. Make sure to keep a shell running until you've validated the new configuration. Restarting the ssh service doesn't affect active connections. –  Gilles Feb 26 '13 at 12:23
    
Hmm, okay I'll experiment and come back with more detail if I continue to have issues. Thanks! –  Michael Waterfall Feb 27 '13 at 11:58
6  
The likely issue is that you put the Match block someplace in the middle of your sshd_config. Match lines affect every following line until the next Match line, so they should be at the end of the file. –  Ken Simon May 16 '13 at 3:11

you can add:

AllowUsers user@192.168.*.*

this changes default behaviour, really deny all other users from all hosts. Match block avilable on OpenSsh version 5.1 and above.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.