I'd like to allow SSH password authentication from only a certain subnet. I see the option to disallow it globally in /etc/ssh/sshd_config:

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

Is there a way to apply this configuration to a select range of IP addresses?

2 Answers 2


Use a Match block at the end of /etc/ssh/sshd_config:

# Global settings
PasswordAuthentication no

# Settings that override the global settings for matching IP addresses only
Match address
    PasswordAuthentication yes

Then tell the sshd service to reload its configuration:

service ssh reload
  • 1
    I tried this (with instead) and when I restarted the ssh service I got locked out. SSH refused any connections. Any idea why this could be? Commented Feb 26, 2013 at 11:24
  • 3
    @MichaelWaterfall It's impossible to tell with so little information. Make sure to keep a shell running until you've validated the new configuration. Restarting the ssh service doesn't affect active connections. Commented Feb 26, 2013 at 12:23
  • 33
    The likely issue is that you put the Match block someplace in the middle of your sshd_config. Match lines affect every following line until the next Match line, so they should be at the end of the file.
    – Ken Simon
    Commented May 16, 2013 at 3:11
  • 6
    Despite the indentation in the answer, sshd_config is not Python ;)
    – Nick T
    Commented Feb 7, 2017 at 17:25
  • 1
    @frepie The Match block extends until the next Match directive or until the end of the file. That's why you have to put it at the end. Commented Dec 19, 2017 at 15:27

you can add:

AllowUsers [email protected].*.*, [email protected].*.*

this changes default behaviour, really deny all other users from all hosts. Match block available on OpenSsh version 5.1 and above.

  • call I allow a group instead of a single user
    – Lamour
    Commented Jul 6, 2016 at 21:16
  • @Lamar From man sshd_config, it looks like AllowGroups works the same as AllowUsers, but AllowUsers seems to take precedence over AllowGroups. Commented Feb 16, 2018 at 17:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .