Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN the user would need to authenticate with both a RSA key and an OTP password generated by a PAM module (via port Y)?

I tried configuring /etc/ssh/sshd_config with the match condition:

match user XX
   LocalPort 22
   PasswordAuthentication no
   RSAAuthentication yes

match user XX
   LocalPort 12345
   PasswordAuthentication yes
   RSAAuthentication no

It gives me the error: bad parameter implying that this command isn't supported, although in the sshd_config manual it says that it is.

In summary, my question is: Is it possible to have different authentication methods for the same user depending on which port they SSH into?

share|improve this question
Does your version of sshd support LocalPort? It's pretty new. – Gilles May 12 '14 at 13:39
@Gilles: After using the ssh -v command, it said that ssh 6.0 was installed. From what I read in the manual, it is supposed to be supported. If it isn't supported, is there a way of adding this function? – Brill May 12 '14 at 14:25
up vote 1 down vote accepted

You could run two ssh daemons listening on separate ports by using two sshd_config files and the -f option of sshd. One configuration file would include the OTP/pam module whilst the other would only allow key-based authentication..

Both would then authenticate the user against their own private key regardless.

One word of caution: you'll have to manually track updates of the SSH daemon, as it's likely that your system would only update one configuration file and not the other.

share|improve this answer
Thanks! The creation of another sshd_config file creates the second daemon? Would I have to have both sshd_config files stored under /etc/ssh/ (obviously with something like 'sshd1_config' and 'sshd2_config')? To track updates/login attempts, etc... I could just set each daemon to output to a different log file. – Brill May 12 '14 at 14:37
@Brill you'll need to run a separate instance of the daemon, pointing at the other configuration. man sshd will show you which option to use. – lorenzog May 12 '14 at 14:53
Thanks...I'll go with that :-) – Brill May 12 '14 at 21:07

Here's a link to a post for a similar situation: Two sshd setups, one forwarding to the other, one using keys, the other an OTP. Not quite what you want, but might help.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.