I'm sure this has been answered before, but I could not locate the answer with Google, and this search. I currently only allow shared key authentication for openssh server on my box. However, I would like to be able to use password auth, when I am connecting locally, via my internal (192.168.1.x) subnet.

Is it possible to use a per-host authentication method in OpenSSH? Thanks!


Use a Match directive in /etc/sshd_config.

PasswordAuthentication No
Match Address
    PasswordAuthentication yes

You can restrict this to a few users (who you trust not to choose terrible passwords), for better security.

PasswordAuthentication No
Match Address User joe,bob
    PasswordAuthentication yes
  • Perfect, thank you! If only I had known that one word, 'Match'! – Jonathon Reinhart Aug 31 '11 at 4:05
  • So I finally tried this, and it does not work: Directive 'PasswordAuthentication' is not allowed within a Match block – Jonathon Reinhart Feb 20 '12 at 0:15
  • @JonathonReinhart That's really weird: I've used this setup several times, and it's always worked for me. What version of OpenSSH are you using, under what OS? – Gilles Feb 20 '12 at 1:08
  • "OpenSSH_4.4p1, OpenSSL 0.9.8d 28 Sep 2006" on SuSE 10.3. I'm in the process of upgrading now (which is why I wanted to look into this) – Jonathon Reinhart Feb 20 '12 at 3:08
  • 1
    @JonathonReinhart Ah, that would explain it, your version is too old. PasswordAuthentication has been permitted in Match blocks only since servconf.c 1.168 which first shipped in OpenSSH 4.6. – Gilles Feb 20 '12 at 3:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.