As sshd service can listen on different ports is it possible to configure a key which will work only if the connection was made on one port, but not the other?

By this I mean that the key appears more than once in the authorized_keys list and the connection will be permitted if it is made on the port specified in the key.

The idea is to use the same key but with a different command= and other option to allow the same key to be used for different services.


Surely you can:

Port 2222
Port 3333
Match LocalPort 2222
        AuthorizedKeysFile /path/to/authorized_keys_1
Match LocalPort 3333
        AuthorizedKeysFile /path/to/authorized_keys_2

See the Match section of the sshd_config(5) manpage for more info about which criteria and directives you can use with a Match block.

  • Can the AuthorizedKeysFile contain more than key, like when multiple users are connecting to a service that port is dedicated to? Can it also be extended to a source ip address or range? – vfclists Jan 14 at 11:58
  • 1
    Yes and yes. You can use multiple conditions in the Match directive: eg. Match LocalPort 2222 Address to only apply to clients which connect to the port 2222 from the address range. Notice that you can experiment with sshd by running it as a regular user (as long as you don't bind to ports < 1024 and don't try to auth other users, you can do almost everything). – mosvy Jan 14 at 15:42
  • Whether this setup provides any additional security benefits is another question... – Mark Jan 14 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.