> Source: [sk168773](https://support.checkpoint.com/results/sk/sk168773)

# sk168773 - Cannot control SSH access to the Gaia machine with Host IP address

| Property | Value |
|----------|-------|
| Solution ID | sk168773 |
| Date Created | 2020-08-24 |
| Last Modified | 2021-02-22 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server |
| Versions | R82.10, R82, R81.20, R82.20 |
| OS | Gaia |

## Symptoms

- * Cannot control SSH access to the Gaia machine with the Host IP Address, but it can control access to the Gaia Portal.   
  \[Gaia Portal\] System Management \< Host Access \< Add Host IP Address.   
  or   
  Edit /config/db/initial
* Other clients are still able to connect, but logins fail because there are no available authentication methods.<br />

* CLI access through Gaia Portal may also work and /var/log/secure will have the following lines:   
  User root from x.x.x.x not allowed because listed in DenyUsers   
  Connection closed by invalid user root x.x.x.x port yyyy \[preauth\]

## Cause

In R80.40, Open SSH deprecated the use of tcp-wrappers (*hosts.allow/hosts.deny* files) in sshd itself.

<br />

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.  

\[Workaround\]  
Do the following:

1. Remove default authentication methods.
2. Add the desired authentication methods after a Match Address at the end of the file.   
   Placing Match at the end of the file is important, since all the configuration lines after it are placed inside the conditional block until the next Match line.

**Example** ;  

1. Edit the **/etc/ssh/sshd_config** file with vi editor:  

   Before:  
   `[Expert@HostName]# vi /etc/ssh/sshd_config`  
   `...`  
   `# To disable tunneled clear text passwords, change to no here!`  
   `#PasswordAuthentication yes`  
   `#PermitEmptyPasswords no`  
   `...`  
   `Match address x.x.x.x`  
   `PasswordAuthentication no`  

   After:  
   `[Expert@HostName]# vi /etc/ssh/sshd_config`  
   `...`  
   `# To disable tunneled clear text passwords, change to no here!`  
   `PasswordAuthentication no`  
   `#PermitEmptyPasswords no`  
   `...`  
   `Match address x.x.x.x`  
   `PasswordAuthentication yes`  

2. Restart sshd:  
   `[Expert@HostName]# /etc/rc.d/init.d/sshd restart`

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content