I checked man pages related to ssh on OS X and other systems and tried using hosts.allow and hosts.deny files as per this post, and sshd_config to no avail.$ cat /etc/hosts.allow sshd: 192.168.0.4/255.255.255.0$ cat /etc/hosts.deny sshd: ALLIn sshd_config I tried using Match without success (I don't remember exactly the config).My system is OS X 10.8.5 and I want the sshd to permit access from local IP 192.168.0.4/24 or its local name and deny it to all other hosts including the gateway 192.168.0.1.Update The solution proposed below by Stephen Kitt works except for the format AllowUsers name/pattern@hostname. This logs the followingsshd[31723]: debug1: attempt 6 failures 5 [preauth]sshd[31723]: debug1: keyboard-interactive devs  [preauth]sshd[31723]: debug1: auth2_challenge: user=test devs= [preauth]sshd[31723]: debug1: kbdint_alloc: devices 'pam' [preauth]sshd[31723]: debug1: auth2_challenge_start: trying authentication method 'pam' [preauth]sshd[31723]: Postponed keyboard-interactive for invalid user test from 192.168.0.4 port 55680 ssh2 [preauth]sshd[31723]: error: PAM: authentication error for illegal user test from 192.168.0.4 via 192.168.0.5sshd[31723]: Failed keyboard-interactive/pam for invalid user test from 192.168.0.4 port 55680 ssh2sshd[31723]: Disconnecting: Too many authentication failures for test [preauth]sshd[31723]: debug1: do_cleanup [preauth]
Is there a canonical method to restrict ssh access to certain IP addresses in Unix?
ssh;osx;freebsd;sshd
Rather than using Match, if you wish to allow logging in from a single host, the following works for me (in sshd_config):AllowUsers *@192.168.0.4It only allows users logging in from 192.168.0.4, using any login on the target. You can replace * with a specific login if you wish, and specify multiple patterns separated by spaces; so for example:AllowUsers user1@192.168.0.4 user2@192.168.0.4