15

1

Match Group GROUPNAME, User *,!root

2

Match Group GROUPNAME User !root

My question: What is the difference between #1 and #2 in the SSHD_CONFIG?

8

The value !root alone doesn't match anything.

The value !root,* matches everything except root.

The man page is not clear about that but it may be that the order matters i.e. *,!root would be the same like * because the * would match and the rest is not checked any more.

5
  • So they differ? :O
    – user74180
    Jul 1 '14 at 16:48
  • @user74180 Yes. Jul 1 '14 at 16:50
  • @HaukeLaging, are you really sure about this? The Match section in sshd_config(5) and the PATTERNS section in ssh_config(5) seem to disagree with this accepted answer by my reading of them.
    – arielf
    Jul 9 '14 at 7:06
  • @arielf I haven't tried it. Otherwise I wouldn't have written "may". The !root,* is from the man page. What exactly do you mean? Jul 9 '14 at 9:04
  • I mean that just by reading the man pages, Raza's answer sounds correct. Of course, to really be sure someone should actually verify it before answering :)
    – arielf
    Jul 9 '14 at 16:32
4

according to this reference, The match patterns may consist of single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS..

Therefore, it should be the same.

2
  • Are you sure it's the same? :O
    – user74180
    Jul 1 '14 at 16:47
  • The openssh man page says By default, login is allowed for all groups this seems to imply that * at the beginning is redundant because it is the default, and !root is the same as *,!root.
    – arielf
    Jul 9 '14 at 6:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.