SSH force public key only for internet connections

jimdaworm · 04-11-2011, 03:20 PM

Hi Everyone

I am wondering if it is possible to force internet/external SSH connections to authenticate with a public key and allow local connections to connect via user and password?

Saludos

Tinkster · 04-11-2011, 08:12 PM

As ssh has no notion of different interfaces (and if you had
external connections forwarded via NAT it would be pretty much
impossible all together) the answer is no; you could compile
a separate sshd w/ a directory structure of its own, a port
to itself, and only permit one form of authentication on that.

Cheers,
Tink

chrism01 · 04-11-2011, 08:30 PM

Actually, looking at the home pages for sshd_config http://www.openbsd.org/cgi-bin/man.c...nfig&sektion=5 it seems to me that you should be able to use the 'Match' keyword, as Authentication types are allowed to be specified inside a Match block.

jimdaworm · 04-12-2011, 12:00 AM

Thanks Tinkster.

Its good to see your still helping people after so many years on this forum! The internet connections will be forwarded via NAT so I understand what your saying, all connections are really coming from the LAN as far as the SSH server is concerned.

Thanks for your input too chrism01, thats an interesting option that I didnt know existed I will keep that in mind is case its useful in the future.

unSpawn · 04-12-2011, 12:39 AM

Quote:

Originally Posted by Tinkster

you could compile a separate sshd w/ a directory structure of its own, a port to itself, and only permit one form of authentication on that.

If you want to run a separate sshd you just need to supply a different config file, right? I mean that's what I do for running a backup sshd out of Xinetd...

Tinkster · 04-12-2011, 01:02 PM

Quote:

If you want to run a separate sshd you just need to supply a different config file, right? I mean that's what I do for running a backup sshd out of Xinetd...

You could, but wouldn't they use the same lock file? I thought that's compiled in.