Ssh: allow all users for one IP, and restrict to one user for public IP

authorizationssh

I have a server on a VPN. This server has a public address and has a gitlab instance on it.
I'd like to be able to connect with any ssh user from the VPN address, but restrict the access to the git user from the public address.

How can I achieve both things at the same time?

I'm already restricting access like this:

# Listen on localhost
ListenAddress 127.0.0.1
# Listen on public address
ListenAddress 1.2.3.4
# Listen on the VPN address
ListenAddress 5.6.7.8

I'm on an Ubuntu server system, using openssh version 1:5.9p1-5ubuntu1

Best Answer

You should be able to achieve this using Match blocks ( localAddress)with additional AllowUsers/DenyUsers filtering in your sshd_config file, like this (assuming 1.2.3.4 is your public address):

Match LocalAddress 1.2.3.4
    AllowUsers git
Related Topic