There is a Match group in the SSHD config:

cat /etc/ssh/sshd_config
    Match Group FOOGROUP
    ForceCommand /bin/customshell

There are many users on the machine that are in the "FOOGROUP".

My question: How can I exclude a given user that is in the "FOOGROUP" from the "Match Group"?


The Match operator can take multiple arguments, allowing very flexible rules. In this case, you could do something like this to achieve what you want.

Match Group FOOGROUP User !username
  ForceCommand /bin/customshell

The ! negates the argument passed to the User criterion, so even if the user username is in the group FOOGROUP, the Match will not be successful, and username will not be given the custom shell upon logging in.

  • And are you 100% sure, that this only excludes the "!username"? And other users that could be in the FOOGROUP will be untouched? – evachristine Jun 18 '14 at 15:10
  • 1
    Yes. I tested it before posting, and it works as I describe. – D_Bye Jun 19 '14 at 21:37

You need to use multiple clauses in your config file entry but in a very specific way. There is a bug in some setups that cause the generally recommended, and simplest, syntax ( "Match Group FOOGROUP User !username" ) to either cause everyone else in the group to fail to Match or lets them escape their chroot jail.

On Debian Jessie using OpenSSH_6.0p1 Debian-4, OpenSSL 1.0.2d I get the result that everyone else in the group can no longer connect. Others report jail breaks. In both cases a syntax of

Match Group FOOGROUP User *,!username

seems to work without side-effects. Some sort of bug in the parser no doubt.


with below option i can jail the sftp user within specified directory and also specified user able to login thru ssh.

Match Group groupname User *,!username


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.