Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


Match Group GROUPNAME, User *,!root


Match Group GROUPNAME User !root

My question: What is the difference between #1 and #2 in the SSHD_CONFIG?

share|improve this question
up vote 8 down vote accepted

The value !root alone doesn't match anything.

The value !root,* matches everything except root.

The man page is not clear about that but it may be that the order matters i.e. *,!root would be the same like * because the * would match and the rest is not checked any more.

share|improve this answer
So they differ? :O – user74180 Jul 1 '14 at 16:48
@user74180 Yes. – Hauke Laging Jul 1 '14 at 16:50
@HaukeLaging, are you really sure about this? The Match section in sshd_config(5) and the PATTERNS section in ssh_config(5) seem to disagree with this accepted answer by my reading of them. – arielf Jul 9 '14 at 7:06
@arielf I haven't tried it. Otherwise I wouldn't have written "may". The !root,* is from the man page. What exactly do you mean? – Hauke Laging Jul 9 '14 at 9:04
I mean that just by reading the man pages, Raza's answer sounds correct. Of course, to really be sure someone should actually verify it before answering :) – arielf Jul 9 '14 at 16:32

according to this reference, The match patterns may consist of single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS..

Therefore, it should be the same.

share|improve this answer
Are you sure it's the same? :O – user74180 Jul 1 '14 at 16:47
The openssh man page says By default, login is allowed for all groups this seems to imply that * at the beginning is redundant because it is the default, and !root is the same as *,!root. – arielf Jul 9 '14 at 6:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.