I have an OpenWrt router, I want to disable password authentication on SSH, so that one can only authenticate with keys. This is easily achieved by following the guide in the documentation, however, I want to only disable password authentication on the WAN interface, is this possible?
This answer applies to OpenSSH. OpenWRT includes Dropbear by default, so you would need to need to replace it, as per this link (basically, install
With OpenSSH, what you'd like is possible using two possible mechanisms:
In the LAN configuration file (eg,
In the WAN configuration file (eg,
In the above, 192.168.1.1 is your LAN interface IP, 10.1.1.1 your WAN IP address and in both cases, 22 the port to listen to. You can specify the configuration file to load by using the
Here, you're disabling password authentication, except for addresses on your LAN (assumed here to be 192.168.1.0/24).
You can run two instances of the SSH server, with different configurations, each listening on a different interface.