I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN the user would need to authenticate with both a RSA key and an OTP password generated by a PAM module (via port Y)?

I tried configuring /etc/ssh/sshd_config with the match condition:

match user XX
   LocalPort 22
   PasswordAuthentication no
   RSAAuthentication yes

match user XX
   LocalPort 12345
   PasswordAuthentication yes
   RSAAuthentication no

It gives me the error: bad parameter implying that this command isn't supported, although in the sshd_config manual it says that it is.

In summary, my question is: Is it possible to have different authentication methods for the same user depending on which port they SSH into?

  • Does your version of sshd support LocalPort? It's pretty new. Commented May 12, 2014 at 13:39
  • @Gilles: After using the ssh -v command, it said that ssh 6.0 was installed. From what I read in the manual, it is supposed to be supported. If it isn't supported, is there a way of adding this function?
    – Brill
    Commented May 12, 2014 at 14:25

3 Answers 3


You could run two ssh daemons listening on separate ports by using two sshd_config files and the -f option of sshd. One configuration file would include the OTP/pam module whilst the other would only allow key-based authentication..

Both would then authenticate the user against their own private key regardless.

One word of caution: you'll have to manually track updates of the SSH daemon, as it's likely that your system would only update one configuration file and not the other.

  • Thanks! The creation of another sshd_config file creates the second daemon? Would I have to have both sshd_config files stored under /etc/ssh/ (obviously with something like 'sshd1_config' and 'sshd2_config')? To track updates/login attempts, etc... I could just set each daemon to output to a different log file.
    – Brill
    Commented May 12, 2014 at 14:37
  • 1
    @Brill you'll need to run a separate instance of the daemon, pointing at the other configuration. man sshd will show you which option to use.
    – lorenzog
    Commented May 12, 2014 at 14:53
  • found details here: askubuntu.com/a/865804/189116 Commented May 14, 2018 at 10:12

In fact match expression must be on the same first line. So this should work as expected in /etc/ssh/sshd_config:

Match User XX LocalPort 22
   PasswordAuthentication no
   RSAAuthentication yes

Match User XX LocalPort 12345
   PasswordAuthentication yes
   RSAAuthentication no

Beware that the Match block ends with end of configuration file or another Match directive. Indentation is only there for prettyness. As a result, DO NOT add some Match lines in the middle of existing configuration file. So simply put your Match blocks at the end of the file.

Warning OpenSSH is compiled with hard-coded limit of listen ports, by default 8 (Debian, Ubuntu...) and startup logic appears to open ports in reverse order compared to configuration directives, with consequence to reject to open default SSH 22 port when you declare more ports than allowed... and you have already guessed you just lose your SSH access to your system! If you need more than 8 SSH ports, I recommend to keep only 22 handled by regular service/daemon, and setup your additional SSH ports thanks to xinetd.

  • I think you meant PubkeyAuthentication instead of RSAAuthentication?
    – smac89
    Commented Nov 18, 2021 at 7:00

Here's a link to a post for a similar situation: https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-wikid-with-putty-and-ssh-for-vnc. Two sshd setups, one forwarding to the other, one using keys, the other an OTP. Not quite what you want, but might help.

  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – Jenny D
    Commented Apr 3, 2017 at 16:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .