Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Specifically AllowUsers parameter:

e.g. convert this

AllowUsers user1 user2 user3 user4

to this

share|improve this question
up vote 9 down vote accepted

No, but it's not useful in this case. You can have multiple AcceptEnv, AllowGroups, AllowUsers, DenyGroups, DenyUsers, HostKey, PermitOpen, Port and Subsystem lines, and each line adds one or more (or sometimes zero) elements to the list.

Nonetheless, if you can't easily fit your AllowUsers directive on one line, I suggest creating a ssh_allowed group and using AllowGroups ssh_allowed in sshd_config.

share|improve this answer
Oh, good point about just having multiple AllowUsers directives – Michael Mrozek Sep 14 '10 at 19:48
One word of caution, looks like AllowGroups and AllowUsers do not tolerate each other (multiple entries of the same type are OK). So, in you configuration stick to either policy, but not both. – Alexander Pogrebnyak Sep 15 '10 at 23:57
You can use both AllowGroups and AllowUsers but if you do the OpenSSH daemon will only let the allowed users log in if they are also in an allowed group. In other words, it's "and" (intersection), not "or" (union). – nwk Mar 5 '14 at 22:42

In short, it looks like no

OpenSSH's servconf.c dumps the file into a buffer without checking for such things (all it appears to do is look for # to mark a comment):

while (fgets(line, sizeof(line), f)) {
    if ((cp = strchr(line, '#')) != NULL)
        memcpy(cp, "\n", 2);
    cp = line + strspn(line, " \t\r");

    buffer_append(conf, cp, strlen(cp));

The function that parses the config then splits the buffer on newlines and processes each line:

while ((cp = strsep(&cbuf, "\n")) != NULL) {
    if (process_server_config_line(options, cp, filename,
        linenum++, &active, user, host, address) != 0)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.