I have two users on my ssh-server machine, user_A and user_B. user_B is permitted to log in with private key only for security reasons, because he needs to log in from remote. All this works. My problem: How do I prevent user_A to login likewise from remote with username/password, because he only needs to login from the local network? According to the man page of sshd, CIDR-notation is allowed.
Match 192.168.0.10/24 AllowGroups PrivateSubnetSshUsers
My version looks like
Match 192.168.10.0/24 AllowUsers user_A
Against my expectations, user_A can still log in from 192.168.1.220 in both cases.
I had done some
systemctl restart sshd before retrying.
What do I overlook here?