Ubuntu – How to allow SSH password authentication from only certain IP addresses

I found the solution at Unix & Linux StackExchange in this question: https://unix.stackexchange.com/questions/67334/openssh-how-to-end-a-match-block

The answer says:

So Match blocks need to be at the end of the sshd_config file.

Sure enough, that solved everything for me.

In fact, it solved my related problems beyond the scope of this question too. My related issue was getting an androVM running and fully function within VirtualBox. I was just using the Ubuntu server for testing to narrow down the issue. In androVM I wanted to use ES File Manager in Android to access files on the host Ubuntu machine via SFTP. Now that works.

You can authenticate using a username/password perfectly fine without a server/CA certificate. However, I highly recommend configuring it to verify it with your CA certificate to prevent Man-in-the-Middle attacks.

Without any server verification anyone can impersonate your OpenVPN server and just accept your username/password. Results:

• The attacker can intercept all traffic. As you don't verify the server you're connecting to, anyone can claim to be your server in a public network (or private network controlled by the attacker).
• The attacker knows your username/password combination. Very very bad in case you reuse the same password for other things as well.

In Network Manager, it works fine without CA Cert as shown below, but please don't use it like that! If you don't use any server/CA certificate on Windows, you're really vulnerable to the above attacks.