Is there a way to tell sshd on a server to _STRICTLY_ only accept an ssh connection from a particular user at a particular IP?

Like say "bob" connects from ip "123.123.123.123", to a server. Can I set the server to ONLY allow bob to connect from that ip, and no other?

If I can do this... mind pointing me to some docs, or a howto? I cant seem to find anything :-(

man sshd_config: AllowUsers, user@host, tho man states if user@host is used both user and host are checked separately so dunno if you have to string this together with DenyUsers to not allow another_user@same_host.

Hmmm... yeah, the man pages were confusing me, so thus why I came here

I will figure it out...

Mainly I am trying to have two servers talk to each other through ssh special users, which I use a signed cert between the machine to do so (so it doesnt ask for password on automated processes)... so I kind of wanted to add a lil bit more security of making ALL those special users only allowed from one server to the other etc, so no one could use them unless they were ON a particular server to begin with.

I'm just a paranoid flick.

Ok. Here's what I can see as a checklist for possible options:
- If you're not providing connectivity for many users, see if you're able to use TCP wrappers to have sshd only accept connections from known trusted hosts, because since sshd-2.9(aprox) doesn't do "AllowFrom" anymore, that would help against ppl connecting from hostX. Same goes for firewalling if you're not providing connectivity for many users and really, really paranoid.
- Using "AllowUsers user0@host0 user1@host1" in sshd_config would allow only those users to connect from that host. The manpage is a bit vague tho stating "user and host are checked separately".
- Next up would be to add the from="" option to each key in authorized_keys to only allow auth per key auth from hosts in their fromlist, if your doing non-interactive logins I guess you already added the command="" to those keys in authorized_keys.

If I'm not forgetting something and these options work, then as far as I can see you'll only have to worry about the usual cert and key grabbing. DenyUsers will only work if you manage to add *all* the users denied access from *all* hosts, which is a nightmare if you manage a lot of hosts needing connections.

HTH somehow.