Question is: How do we only allow specific users coming from either their domain or using our domain in an appropriate way (SSH/SFTP)? E.G.
firstname.lastname@example.org coming from customersIPaddress is Denied and email@example.com coming from randomIPaddress is not allowed and firstname.lastname@example.org is not allowed
In Centos 7, our sshd_config has this additional config:
Match Address 192.168.1.0/24 AllowUsers bob trev Match Address *,!192.168.1.0/24 AllowGroups sftpgroup Match All PermitRootLogin no
sftpgroup is a group of our customers, that have their own root directories. but the above config UNFORTUNATELY Allows our customers' "employees" to login from unknown ip addresses, and it also allows them to use one of our other domains to login.
I tried this, and external users/groups stopped working:
Match Address 192.168.1.0/24 AllowUsers bob trev Match Address *,!192.168.1.0/24 AllowUsers email@example.com AllowGroups sftponly Match All PermitRootLogin no
NB: bob and trev are our employees who only access from internally (they are not in the sftpgroup)