How to restrict user login for specific IP-address (private address)?

Question

I have two users on my ssh-server machine, user_A and user_B. user_B is permitted to log in with private key only for security reasons, because he needs to log in from remote. All this works. My problem: How do I prevent user_A to login likewise from remote with username/password, because he only needs to login from the local network? According to the man page of sshd, CIDR-notation is allowed.

What I have done:
#605433 suggests AllowUsers [email protected], so I adapted to AllowUsers [email protected]/24

#740700 suggests:

Match 192.168.0.10/24
   AllowGroups PrivateSubnetSshUsers

My version looks like

Match 192.168.10.0/24
   AllowUsers user_A

Against my expectations, user_A can still log in from 192.168.1.220 in both cases. I had done some systemctl restart sshd before retrying.

What do I overlook here?

Answer 1

First, there is error in your Match statement as it should be Match address 192.168.10.0/24 and not just Match 192.168.10.0/24. Your version gives an error message when trying to restart sshd. Didn't you get one?

Second, you should Match on user name, not on address. The following should work:

Match user user_A
   AllowUsers [email protected]/24

BTW. From my tests, AllowUsers [email protected]/24 alone (ie. not in Match block) also works (so you must have done something wrong when testing it), but it restricts all other users except user_A from login at all (and user_A can login only from the specified network). If it is within a Match block as above, then user_A can login only from specified network, and all other users can login from any IP address.

Answer 2

I am utmost embarrassed. Of course.the case is solved, like raj had correctly indicated. My fault, and therefore embarrassment, was to always edit ssh_config, and not sshd_config. My apologies, and thanks again for your help!

Answer 3

According to the manual (https://www.man7.org/linux/man-pages/man5/sshd_config.5.html), it should work like this:

# Only user_B is allowed to login
AllowUsers user_B

# Only the group PrivateSubnetSshUsers is allowed to login from the network 192.168.10.0/24
Match Address 192.168.10.0/24
        AllowGroups PrivateSubnetSshUsers 

# user_B is not allowed to login with password
Match User user_B
        PasswordAuthentication no

With the first option you lock out all users except of the user_B. The second option allows a login if you connect from the given network and are member of the group PrivateSubnetSshUsers. The third option force user_B to use keys.

It is not super straight forward, but it should do the job.