Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm sure this has been answered before, but I could not locate the answer with Google, and this search. I currently only allow shared key authentication for openssh server on my box. However, I would like to be able to use password auth, when I am connecting locally, via my internal (192.168.1.x) subnet.

Is it possible to use a per-host authentication method in OpenSSH? Thanks!

share|improve this question
add comment

1 Answer 1

up vote 4 down vote accepted

Use a Match directive in /etc/sshd_config.

PasswordAuthentication No
Match Address 192.168.1.0/24
    PasswordAuthentication yes

You can restrict this to a few users (who you trust not to choose terrible passwords), for better security.

PasswordAuthentication No
Match Address 192.168.1.0/24 User joe,bob
    PasswordAuthentication yes
share|improve this answer
    
Perfect, thank you! If only I had known that one word, 'Match'! –  Jonathon Reinhart Aug 31 '11 at 4:05
    
So I finally tried this, and it does not work: Directive 'PasswordAuthentication' is not allowed within a Match block –  Jonathon Reinhart Feb 20 '12 at 0:15
    
@JonathonReinhart That's really weird: I've used this setup several times, and it's always worked for me. What version of OpenSSH are you using, under what OS? –  Gilles Feb 20 '12 at 1:08
    
"OpenSSH_4.4p1, OpenSSL 0.9.8d 28 Sep 2006" on SuSE 10.3. I'm in the process of upgrading now (which is why I wanted to look into this) –  Jonathon Reinhart Feb 20 '12 at 3:08
    
@JonathonReinhart Ah, that would explain it, your version is too old. PasswordAuthentication has been permitted in Match blocks only since servconf.c 1.168 which first shipped in OpenSSH 4.6. –  Gilles Feb 20 '12 at 3:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.