SSH configuration with two interfaces (different users) works only on one interface

Question

I have created a sshd_config for my server. The SSH service should listen on the public and a WireGuard interface (on different ports). My problem now is that on the first public interface everything works, but on the second one somehow the rules of the first one were taken over. So I can login with jona, but not with root ... the solution will probably be simple, but I've been trying to get it to work properly for days.

#Include /etc/ssh/sshd_config.d/*.conf

ListenAddress ---.---.---.---:51830
ListenAddress 10.210.1.1:22

PasswordAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PubkeyAuthentication no
#AuthorizedKeysFile     .ssh/authorized_keys


StrictModes yes
MaxAuthTries 3
LoginGraceTime 30s
UsePAM yes


Subsystem sftp /usr/lib/openssh/sftp-server

Match Address ---.----.----
        PermitRootLogin no
        AllowUsers jona
        MaxSessions 2
        AllowTcpForwarding no
        X11Forwarding no
        GatewayPorts no
        PermitOpen any

Match Address 10.210.1.1
        PermitRootLogin yes
        AllowUsers root
        ForceCommand internal-sftp
        MaxSessions 10
        AllowTcpForwarding no
        X11Forwarding yes
        GatewayPorts yes
        PermitOpen any

Thank you for your time :)

score 1 · Accepted Answer · answered Apr 03 '23 at 04:48

Match Address matches the remote address of the client, so neither of the sections is being matched and the global defaults are used instead (which normally permit root login only with public-key or kerberos, but not with a password). You were looking for Match LocalAddress.

SSH configuration with two interfaces (different users) works only on one interface

1 Answers1