You should be able to do this with a Match
directive.
Before you start, make sure you have at least one account with working key-based access to the server (or physical access).
Then edit the server's /etc/ssh/sshd_config
file, adding your match block at the end e.g.
Match User john Address 192.168.1.0/24
PasswordAuthentication yes
Note that this expresses two conditions, User john
and Address 192.168.1.0/24
, both of which must be satisfied in order for PasswordAuthentication yes
to be applied. The 0/24
is CIDR notation for any address in the 192.168.1.x subnet.
Now you can disable password authentication for other user-address combinations in the main body of the configuration, finding the section beginning:
# Change to no to disable tunnelled clear text passwords
and changing the default
#PasswordAuthentication yes
to
PasswordAuthentication no
Finally, restart the service - for systemd
based init systems, you can do that using
sudo systemctl restart ssh.service
You can test that non-matching users can no longer authenticate using passwords by forcing the client to try e.g.
$ ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no [email protected]
which should fail with a message like
Permission denied (publickey).
whereas john
should be prompted for a password:
$ ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no [email protected]
[email protected]'s password:
Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-116-generic x86_64)
If you want password authentication to be the preferred mechanism for john
when on the local network, you may need to specify that in the corresponding client configuration i.e. ~/.ssh/ssh_config