Question is: How do we only allow specific users coming from either their domain or using our domain in an appropriate way (SSH/SFTP)? E.G.
email@example.com coming from customersIPaddress is Denied and firstname.lastname@example.org coming from randomIPaddress is not allowed and email@example.com is not allowed
In Centos 7, our sshd_config has this additional config:
Match Address 192.168.1.0/24 AllowUsers bob trev Match Address *,!192.168.1.0/24 AllowGroups sftpgroup Match All PermitRootLogin no
sftpgroup is a group of our customers, that have their own root directories. but the above config UNFORTUNATELY Allows our customers' "employees" to login from unknown ip addresses, and it also allows them to use one of our other domains to login.
I tried this, and external users/groups stopped working:
Match Address 192.168.1.0/24 AllowUsers bob trev Match Address *,!192.168.1.0/24 AllowUsers firstname.lastname@example.org AllowGroups sftponly Match All PermitRootLogin no
NB: bob and trev are our employees who only access from internally (they are not in the sftpgroup)