0

I just set up my sshd_config to only accept authorized key instead of passwords to help secure my network. Is it possible to make this restriction only apply to external IPs and allow me to still use passwords from computers on my network?

1 Answer 1

1

You might be able to do something through the Match directive in the sshd_config file. This is untried.

Match Host *.my.net
    PasswordAuthentication yes
Match Host !*.my.net
    PasswordAuthentication no
    PubkeyAuthentication yes

These need to be at the end of the config file. Read the sshd_config manpage for more details.

I would not restrict Pubkey authentication for your local network. Myself, I would go so far as requiring pubkey for local as well.

5
  • My plan is to allow pub key everywhere, but also allow passwords internally. Why don't you recommend this?
    – Jarvin
    Dec 18, 2011 at 20:35
  • The private key is kept on the user's box and is not copied, transmitted or accessible to the outside through the SSH protocols. With password authentication, the password is transmitted (through an encrypted channel, yes). Also, with pubkey plus ssh agents, password/passphrases are entered once per session, which means less chance of mistyping passwords. Assuming that you trust the credentials on your local network, then Pubkey could be considered sufficient authentication. I also use pubkey authentication (with command="" in authorized_keys) to audit who is signs into shared accounts.
    – Arcege
    Dec 18, 2011 at 21:42
  • @Arcege, I think you misunderstood the restrictions required — it should be "Password no, Pubkey yes" for connections from outside. Dec 18, 2011 at 23:33
  • No, I just mistyped.. get that with two 5yos running around.. my apologies. Also need Host added to the Match line.
    – Arcege
    Dec 18, 2011 at 23:37
  • @Dan: A reasons for not allowing password-based authentication internally would be that it provides a mechanism for intruders to guess passwords by brute-force or dictionary attack. Your premises are not only used by trusted employees but by temporary cleaning staff, workmen and other visitors. If one existing machine catches a virus (or a visitor's laptop/tablet/phone has a trojan) that malware is now in an environment with weaker security and has an easier task of breaking into other computers. Dec 19, 2011 at 9:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .