99

I'd like to allow SSH password authentication from only a certain subnet. I see the option to disallow it globally in /etc/ssh/sshd_config:

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

Is there a way to apply this configuration to a select range of IP addresses?

152

Use a Match block at the end of /etc/ssh/sshd_config:

# Global settings
…
PasswordAuthentication no
…

# Settings that override the global settings for matching IP addresses only
Match address 192.0.2.0/24
    PasswordAuthentication yes

Then tell the sshd service to reload its configuration:

service ssh reload
  • 1
    I tried this (with 192.168.0.0/16 instead) and when I restarted the ssh service I got locked out. SSH refused any connections. Any idea why this could be? – Michael Waterfall Feb 26 '13 at 11:24
  • 2
    @MichaelWaterfall It's impossible to tell with so little information. Make sure to keep a shell running until you've validated the new configuration. Restarting the ssh service doesn't affect active connections. – Gilles Feb 26 '13 at 12:23
  • 28
    The likely issue is that you put the Match block someplace in the middle of your sshd_config. Match lines affect every following line until the next Match line, so they should be at the end of the file. – Ken Simon May 16 '13 at 3:11
  • 6
    Despite the indentation in the answer, sshd_config is not Python ;) – Nick T Feb 7 '17 at 17:25
  • 1
    @frepie The Match block extends until the next Match directive or until the end of the file. That's why you have to put it at the end. – Gilles Dec 19 '17 at 15:27
7

you can add:

AllowUsers user1@192.168.*.*, user2@192.168.*.*

this changes default behaviour, really deny all other users from all hosts. Match block available on OpenSsh version 5.1 and above.

  • call I allow a group instead of a single user – Lamar Jul 6 '16 at 21:16
  • @Lamar From man sshd_config, it looks like AllowGroups works the same as AllowUsers, but AllowUsers seems to take precedence over AllowGroups. – conradkdotcom Feb 16 '18 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.