Home / ubuntu / Questions / 101670
Accepted
ændrük
Asked: 2012-02-06 09:25:28 +0800 CST

How can I allow SSH password authentication from only certain IP addresses?

  • 772

I'd like to allow SSH password authentication from only a certain subnet. I see the option to disallow it globally in /etc/ssh/sshd_config:

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

Is there a way to apply this configuration to a select range of IP addresses?

configuration security ssh password authentication

2 Answers

  1. Best Answer

    Use a Match block at the end of /etc/ssh/sshd_config:

    # Global settings
…
PasswordAuthentication no
…

# Settings that override the global settings for matching IP addresses only
Match address 192.0.2.0/24
    PasswordAuthentication yes

    Then tell the sshd service to reload its configuration:

    service ssh reload
    • 191

  2. you can add:

    AllowUsers [email protected].*.*, [email protected].*.*

    this changes default behaviour, really deny all other users from all hosts. Match block available on OpenSsh version 5.1 and above.

    • 9