up vote 0 down vote favorite
share [g+] share [fb]

I just set up my sshd_config to only accept authorized key instead of passwords to help secure my network. Is it possible to make this restriction only apply to external IPs and allow me to still use passwords from computers on my network?

link|improve this question
90% accept rate
feedback

1 Answer

up vote 1 down vote accepted

You might be able to do something through the Match directive in the sshd_config file. This is untried.

Match Host *.my.net
    PasswordAuthentication yes
Match Host !*.my.net
    PasswordAuthentication no
    PubkeyAuthentication yes

These need to be at the end of the config file. Read the sshd_config manpage for more details.

I would not restrict Pubkey authentication for your local network. Myself, I would go so far as requiring pubkey for local as well.

link|improve this answer
My plan is to allow pub key everywhere, but also allow passwords internally. Why don't you recommend this? – Dan Dec 18 '11 at 20:35
The private key is kept on the user's box and is not copied, transmitted or accessible to the outside through the SSH protocols. With password authentication, the password is transmitted (through an encrypted channel, yes). Also, with pubkey plus ssh agents, password/passphrases are entered once per session, which means less chance of mistyping passwords. Assuming that you trust the credentials on your local network, then Pubkey could be considered sufficient authentication. I also use pubkey authentication (with command="" in authorized_keys) to audit who is signs into shared accounts. – Arcege Dec 18 '11 at 21:42
@Arcege, I think you misunderstood the restrictions required — it should be "Password no, Pubkey yes" for connections from outside. – grawity Dec 18 '11 at 23:33
No, I just mistyped.. get that with two 5yos running around.. my apologies. Also need Host added to the Match line. – Arcege Dec 18 '11 at 23:37
@Dan: A reasons for not allowing password-based authentication internally would be that it provides a mechanism for intruders to guess passwords by brute-force or dictionary attack. Your premises are not only used by trusted employees but by temporary cleaning staff, workmen and other visitors. If one existing machine catches a virus (or a visitor's laptop/tablet/phone has a trojan) that malware is now in an environment with weaker security and has an easier task of breaking into other computers. – RedGrittyBrick Dec 19 '11 at 9:43
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.