Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm using a Match block in OpenSSH's /etc/ssh/sshd_config (on debian) to restrict some users to SFTP:

# my stuff
Match group sftponly
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp -u 0002
    ChrootDirectory %h

As you can see, I use a #my stuff comment in custom config files to easily distinguish default configurations from those I made (and I put those at the end of the config files).
Now I wanted to append the directive UseDNS no to the configuration (to speed up logins) but OpenSSH said Directive 'UseDNS' is not allowed within a Match block.

Now I was wondering whether there is a syntax like End Match to end those match blocks?

share|improve this question

1 Answer 1

up vote 8 down vote accepted

It seems there is no way to explicitly end Match blocks. From the sshd_config manual page:

If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.

So Match blocks need to be at the end of the sshd_config file.

share|improve this answer
1  
Another option is to have a line with nothing but Match on it, which effectively matches everything and therefore is the same as 'ending' the block. This still won't let you use directives that aren't allowed in Match blocks, though, so it won't help with your particular scenario. –  Nathan Bouscal Apr 28 '13 at 2:28
    
"Match blocks need to be at the end of the sshd_config file." Very helpful to me and not explained clearly enough (for me) in the man page, etc. Thanks. –  MountainX Apr 29 '13 at 22:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.