SSH allow root from specific ip address


The syntax is pretty simple:

Match condition 
  Override config option 1
  Override config option 2

You can use the following as condition:

  1. User – Specifies the user to match. For example, if user is root allow login with ssh-keys but disallow everyone else.
  2. Group – Specifies the group to match. For example, If user in group admin, allow login but disallow everyone else.
  3. Host – Specifies the host to match
  4. LocalAddress – Specifies and match the the local (listen) address and port upon which the incoming connection was received via LocalAddress and LocalPort clauses.
  5. LocalPort – Same as above.
  6. Address – Specifies the IP address or IP/subnet to match in CIDR format.

Example: Allow root login from from with ssh-key but disallow everyone else

Append the following in your /etc/ssh/sshd_config:

$ sudo vi /etc/ssh/sshd_config

## Block root login to every one ##
PermitRootLogin no
## No more password login  ##
PermitEmptyPasswords no
PasswordAuthentication no
## Okay allow root login with public ssh key for ##
Match Address
        PermitRootLogin yes

$ sudo systemctl reload sshd

You can setup multiple IP address/CIDR as follows:

PermitRootLogin no
PermitEmptyPasswords no
PasswordAuthentication no
Match Address,,
        PermitRootLogin yes


Source :