After further investigation, I found that by adding

AuthenticationMethods publickey

to the main portion of sshd_config  and adding

AuthenticationMethods publickey password

to the match block, it now works as expected.  I don't know how this functions differently than my prior setup, but at least it is working.

On May 4 2021, at 2:33 pm, Rob Crittenden <> wrote:
Eamon Doyle via FreeIPA-users wrote:
> I am trying to require ssh keys for SSH connections that originate outside of a subnet but allowing password auth within a subnet. Before setting up FreeIPA, I did this by setting the following in my sshd_config:
> PasswordAuthentication no
> Match Address 172.16.0.*
> PasswordAuthentication yes
> After setting up FreeIPA, this configuration seems to be ignored. Instead, password authentication seems to be allowed from any connection if key-based auth fails. I presume I need to make changes to the sssd configuration but I'm having trouble finding any info on achieving this. Any info would be helpful.

I assume you confirmed that your configuration was preserved after
running ipa-client-install?