0

I want to configure my raspberry to allow authentication only with public key crypto to make it more secure and make ssh-ing easier. However, my network folder on the Windows 10 machine I want to ssh from is no longer connecting to it because Win 10 seems to be unable to attach a network folder with RSA. At least I have not found an option to add a folder via RSA, only userame password authentification.

I want to be to use username/password authentication for the network folder from my main machine wich is in the same local network, but only allow RSA from any other machine.

So far I've modified my sshd_config so the only non-#-ed the lines are

PubkeyAuthentication yes
ChallengeResponseAuthentication no

PasswordAuthentication no
Match Address 192.168.2.0/24
  PasswordAuthentication yes
Match All

Subsystem sftp /usr/lib/openssh/sftp-server

and the standard config.

4
  • What are the "obvious reasons"? Nearly all SFTP/sshfs clients support public key authentication and have no reason to stop working. Sep 21, 2019 at 20:15
  • I think I should have added that I used Win 10 file explorer
    – Tharrry
    Sep 21, 2019 at 20:52
  • Okay, that makes it even less obvious, because the file explorer uses SMB, whose configuration is completely separate from SSH/SFTP. Sep 22, 2019 at 20:31
  • @grawity My bad, updated it.
    – Tharrry
    Sep 25, 2019 at 18:12

1 Answer 1

1

Yes, you can do that with the Match command in sshd_config (look for "conditional block" in the manual)

PasswordAuthentication no

Match Address 192.168.1.0/24
  PasswordAuthentication yes

That would allow PaswordAuthentication just from your local network (assuming it is 192.168.1.0/24).

The Match block should be at the end, but if it is not, and you want to close it, you can do it with

Match All
7
  • now my only not-#ed lines are the ones you wrote above, ChallengeResponseAuth no. I restarted the ssh service and ssh work, but the network folder thing does not. Is there something else to do to get sshfs working?
    – Tharrry
    Sep 22, 2019 at 9:16
  • You didn't need to comment all other lines. You actually need things like Subsystem sftp /usr/lib/openssh/sftp-server for sshfs to work. Make sure the Address matches your actual network and mask. You can also put a single IP address there. Can you send the output of the sshfs command with -o debug_sshfs? Sep 22, 2019 at 16:34
  • Subsystem sftp /usr/lib/openssh/sftp-server does this go into the sshd_config?In sshd_config most everything was commented out by default. -o debug_sshfs what is supposed to go before the -o?
    – Tharrry
    Sep 25, 2019 at 11:39
  • Yes, it goes into sshd_config. The -o debug_sshfs is a parameter, you should add it to your current sshfs command so that it reads like this: sshfs -o debug_sshfs user@host:/remote/directory /your/local/directory Sep 25, 2019 at 14:07
  • I had not used the sshfs command previously I believe. Would I not use that command on the machine I want to grant access to a directory on the machine being ssh'd to?
    – Tharrry
    Sep 25, 2019 at 17:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .