In sshd_config(5), this config segment:
Match Address fe80::/10 PasswordAuthentication yes
... is not matching link-local IPv6 addresses as expected. Why and how to fix?
I am trying to configure
sshd to only allow password authentication when connecting from local addresses. Otherwise public key authentication is required. This is the relevant config in
PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys PasswordAuthentication no # Allow password auth on local network Match Address 169.254.0.0/16,192.168.0.0/16 PasswordAuthentication yes Match Address fe80::/10 PasswordAuthentication yes
- Public key authentication enabled on all addresses, as expected.
- Password authentication enabled on address range
169.254.0.0/16,192.168.0.0/16when connecting via IPv4, as expected.
What does not work:
- Password authentication is not enabled on address range
fe80::/10when connecting via IPv6.
Relevant line in
sshd: Connection reset by fe80::39c9:9db5:5a2a:1299%eth0 port 60468 [preauth]
... which is an address that should be matched by
Checklist items I've done:
- IPv6 traffic is not blocked by firewall
sshdis listening on both stacks
$ netstat -tupln | grep sshd tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 8903/sshd tcp6 0 0 :::22 :::* LISTEN 8903/sshd
- Combining / splitting the
Matchstatements for IPv4 and IPv6 does nothing
Match Address 169.254.0.0/16,192.168.0.0/16,fe80::/10This doesn't work either.
- Putting the IPv6 address in square brackets
Match Address [fe80::]/10No bueno.
sshddoes not log any config error in
- Not a client problem - tried OpenSSH, PuTTY, WinSCP and got the same error
sshd running on CentOS 7
$ uname -msr Linux 5.4.72-v8.1.el7 aarch64 $ ssh -V OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
I've already asked this question over on
/r/sysadmin's discord server, and people's reaction was "weird". See our full conversation here if you are interested. It has some more minor details on the different things I tried.