I'm trying to only allow external SSH connections with an ssh key, but allow internal ssh logins with a password. It seems like this is possible but I can't seem to make it work with the options that I am trying. I thought the following entries in sshd_config would only permit root logins from the listed subnets -- is that wrong? It doesn't seem to work properly. AllowUsers root@192.168.*AllowUsers root@10.0.* I'm unable to block the SSH ports on the network firewall since it will block the vendors from logging in with their SSH keys. Too late for me to change the ports to something higher. I basically just want to allow root to login from local IPs and remove the possibility of people attempting to try to ssh to root all day long. IPS rules are helping with that but i'd like to have the piece of mind that external login without a key is never going to work. 
Only allow internal password ssh logins, always allow external ssh logins with key
ssh;sshd