I'm trying to only allow external SSH connections with an ssh key, but allow internal ssh logins with a password. It seems like this is possible but I can't seem to make it work with the options that I am trying.

I thought the following entries in sshd_config would only permit root logins from the listed subnets -- is that wrong? It doesn't seem to work properly.

AllowUsers root@192.168.*
AllowUsers root@10.0.* 

I'm unable to block the SSH ports on the network firewall since it will block the vendors from logging in with their SSH keys. Too late for me to change the ports to something higher. I basically just want to allow root to login from local IPs and remove the possibility of people attempting to try to ssh to root all day long. IPS rules are helping with that but i'd like to have the piece of mind that external login without a key is never going to work.

  • What specifically isn't working properly? Have you tried using match blocks? What does the rest of your sshd_config look like?
    – igal
    Jun 13, 2017 at 4:26

1 Answer 1


Something like:

AuthenticationMethods publickey
Match Address
    AuthenticationMethods publickey password

Adapting the IP block to what you need.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.