1

All users must only login using keys only except John, he can login using keys and if he's using the local network 192.168.1.x then he could ssh using a password, but he can't do login using a password from random IPs.

I don't know how to write the rule for john. Do I do AllowUsers [email protected] ? But how to deny John from different ips? What happens if John connected using a different port?

What is the best way to do it?

1 Answer 1

2

You should be able to do this with a Match directive.

Before you start, make sure you have at least one account with working key-based access to the server (or physical access).

Then edit the server's /etc/ssh/sshd_config file, adding your match block at the end e.g.

Match User john Address 192.168.1.0/24
    PasswordAuthentication yes

Note that this expresses two conditions, User john and Address 192.168.1.0/24, both of which must be satisfied in order for PasswordAuthentication yes to be applied. The 0/24 is CIDR notation for any address in the 192.168.1.x subnet.

Now you can disable password authentication for other user-address combinations in the main body of the configuration, finding the section beginning:

# Change to no to disable tunnelled clear text passwords

and changing the default

#PasswordAuthentication yes

to

PasswordAuthentication no

Finally, restart the service - for systemd based init systems, you can do that using

sudo systemctl restart ssh.service

You can test that non-matching users can no longer authenticate using passwords by forcing the client to try e.g.

$ ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no [email protected]

which should fail with a message like

Permission denied (publickey).

whereas john should be prompted for a password:

$ ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no [email protected]
[email protected]'s password: 
Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-116-generic x86_64)

If you want password authentication to be the preferred mechanism for john when on the local network, you may need to specify that in the corresponding client configuration i.e. ~/.ssh/ssh_config

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .