Search code examples
authenticationpasswordsopensshsshd

sshd, password for local network, keys for external interface

Is there any easy way to set sshd_config (for opensshd 6.7) options in a way that I can use passwords on connections from 192.168.* network, but restrict authentication to key only from everywhere else?

I trust my firewall enough that i won't have external connections coming in sporting IPs in that range as the source, and I am willing to bet on that for the convenience of using passwords in the local network.

Solution

  • There is Match block available in ssh_config, where you can set up IP addresses and subnets:

    PasswordAuthentication no
Match Address 192.168.0.0/16
  PasswordAuthentication yes