I'm trying to configure the following restrictions in my
- Users with local IP addresses face no restrictions
- Users with non-local IP addresses, who are in the
sftpgroup, are allowed to use sftp in a chroot jail
- Users with non-local IP addresses, who are not in the
sftpgroup, are not allowed to do anything.
Here's what I came up with:
Match Address 10.0.0.0/24,172.16.0.0/20,192.168.0.0/16 X11Forwarding yes Match Address *,!10.0.0.0/24,!172.16.0.0/20,!192.168.0.0/16 Group sftp X11Forwarding no AllowTcpForwarding no ChrootDirectory %h ForceCommand internal-sftp Match Address *,!10.0.0.0/24,!172.16.0.0/20,!192.168.0.0/16 Group *,!sftp X11Forwarding no AllowTcpForwarding no ForceCommand /sbin/nologin
The problem: when I try to login from an internal address, as a non-sftp user, I get rejected; the third Match triggered.
According to the
sshd_config manpage, a Match is only satisfied if all of its clauses are satisfied, but in my case, the first clause is not satisfied (I am coming in from a machine with a 172.16.0.0/20 IP address), only the second one is (I am not in the sftp group).
sshd_config manpage wrong? Is it possible to do what I am trying to do?
UPDATE: at @steve's suggestion, I ran sshd in debug mode, and got this:
debug1: userauth-request for user root service ssh-connection method none debug1: attempt 0 failures 0 debug1: connection from 172.19.187.49 matched 'Address *,!10.0.0.0/24,!172.16.0.0/20,!192.168.0.0/16' at line 144 debug1: user root does not match group list sftp at line 144 debug1: connection from 172.19.187.49 matched 'Address *,!10.0.0.0/24,!172.16.0.0/20,!192.168.0.0/16' at line 150 debug1: user root matched group list *,!sftp at line 150 debug1: PAM: initializing for "root"
The no-internal-adress clauses are matching; also, the first Match is not mentioned in the debug log, which seems odd.
As @Gilles pointed out, my address specifications as shown above are incorrect. What I should have used was 10.0.0.0/8, not 10.0.0.0/24, and 172.16.0.0/12, not 172.16.0.0/20. I was counting the mask bits down from 32 instead of up from 0. Yikes.
With the corrected addresses, the configuration works. Thanks Gilles and Uriel!
(I also changed the /sbin/nologin in the last line to /bin/false; the former leads to a strange error message from sftp:
Received message too long 1416128883.)