1

I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN the user would need to authenticate with both a RSA key and an OTP password generated by a PAM module (via port Y)?

I tried configuring /etc/ssh/sshd_config with the match condition:

match user XX
   LocalPort 22
   PasswordAuthentication no
   RSAAuthentication yes

match user XX
   LocalPort 12345
   PasswordAuthentication yes
   RSAAuthentication no

It gives me the error: bad parameter implying that this command isn't supported, although in the sshd_config manual it says that it is.

In summary, my question is: Is it possible to have different authentication methods for the same user depending on which port they SSH into?

  • Does your version of sshd support LocalPort? It's pretty new. – Gilles May 12 '14 at 13:39
  • @Gilles: After using the ssh -v command, it said that ssh 6.0 was installed. From what I read in the manual, it is supposed to be supported. If it isn't supported, is there a way of adding this function? – Brill May 12 '14 at 14:25
2

You could run two ssh daemons listening on separate ports by using two sshd_config files and the -f option of sshd. One configuration file would include the OTP/pam module whilst the other would only allow key-based authentication..

Both would then authenticate the user against their own private key regardless.

One word of caution: you'll have to manually track updates of the SSH daemon, as it's likely that your system would only update one configuration file and not the other.

  • Thanks! The creation of another sshd_config file creates the second daemon? Would I have to have both sshd_config files stored under /etc/ssh/ (obviously with something like 'sshd1_config' and 'sshd2_config')? To track updates/login attempts, etc... I could just set each daemon to output to a different log file. – Brill May 12 '14 at 14:37
  • 1
    @Brill you'll need to run a separate instance of the daemon, pointing at the other configuration. man sshd will show you which option to use. – lorenzog May 12 '14 at 14:53
  • found details here: askubuntu.com/a/865804/189116 – Dreaded semicolon May 14 '18 at 10:12
1

In fact match expression must be on the same first line. So this should work as expected in /etc/ssh/sshd_config:

Match User XX LocalPort 22
   PasswordAuthentication no
   RSAAuthentication yes

Match User XX LocalPort 12345
   PasswordAuthentication yes
   RSAAuthentication no

Beware that the Match block ends with end of configuration file or another Match directive. Indentation is only there for prettyness. As a result, DO NOT add some Match lines in the middle of existing configuration file. So simply put your Match blocks at the end of the file.

-1

Here's a link to a post for a similar situation: https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-wikid-with-putty-and-ssh-for-vnc. Two sshd setups, one forwarding to the other, one using keys, the other an OTP. Not quite what you want, but might help.

  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Jenny D Apr 3 '17 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.