Adding user override to sshd_config causes ssh_exchange_identification error

Question

I wanted to allow SSH TCP forwarding for a specific user, so I added this section to sshd_config:

Match User rainmannoodles
    AllowTcpForwarding yes
    TCPKeepAlive yes

After that change, I get the following message when connecting:

ssh_exchange_identification: Connection closed by remote host

If I comment out the Match User block, everything works fine. That block is the last one in the file.

I can't think of any reason for this behavior. What exactly is going on here? Here's the full -vvv output:

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to localhost [::1] port 22.
debug1: Connection established.
debug1: identity file /Users/rainmannoodles/.ssh/id_rsa type -1
debug1: identity file /Users/rainmannoodles/.ssh/id_rsa-cert type -1
debug1: identity file /Users/rainmannoodles/.ssh/id_dsa type -1
debug1: identity file /Users/rainmannoodles/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
ssh_exchange_identification: Connection closed by remote host

Answer 1

Check the logs on the server to see what's going wrong.

I expect sshd is complaining that your configuration file is ill-formed. The option TCPKeepAlive cannot be used in a Match block, presumably because sshd doesn't support changing the value of the option once authentication has finished (this option is used from the start of the connection, before Match conditions can be tested).