I'm trying to configure the following restrictions in my sshd_config:

  1. Users with local IP addresses face no restrictions
  2. Users with non-local IP addresses, who are in the sftp group, are allowed to use sftp in a chroot jail
  3. Users with non-local IP addresses, who are not in the sftp group, are not allowed to do anything.

Here's what I came up with:

Match Address,,
        X11Forwarding yes

Match Address *,!,!,! Group sftp
        X11Forwarding no
        AllowTcpForwarding no
        ChrootDirectory %h
        ForceCommand internal-sftp

Match Address *,!,!,! Group *,!sftp
        X11Forwarding no
        AllowTcpForwarding no
        ForceCommand /sbin/nologin

The problem: when I try to login from an internal address, as a non-sftp user, I get rejected; the third Match triggered.

According to the sshd_config manpage, a Match is only satisfied if all of its clauses are satisfied, but in my case, the first clause is not satisfied (I am coming in from a machine with a IP address), only the second one is (I am not in the sftp group).

Is the sshd_config manpage wrong? Is it possible to do what I am trying to do?

UPDATE: at @steve's suggestion, I ran sshd in debug mode, and got this:

debug1: userauth-request for user root service ssh-connection method none
debug1: attempt 0 failures 0
debug1: connection from matched 'Address *,!,!,!' at line 144
debug1: user root does not match group list sftp at line 144
debug1: connection from matched 'Address *,!,!,!' at line 150
debug1: user root matched group list *,!sftp at line 150
debug1: PAM: initializing for "root"

The no-internal-adress clauses are matching; also, the first Match is not mentioned in the debug log, which seems odd.


As @Gilles pointed out, my address specifications as shown above are incorrect. What I should have used was, not, and, not I was counting the mask bits down from 32 instead of up from 0. Yikes.

With the corrected addresses, the configuration works. Thanks Gilles and Uriel!

(I also changed the /sbin/nologin in the last line to /bin/false; the former leads to a strange error message from sftp: Received message too long 1416128883.)

  • worth using sshd -d to get some debug output, see what's happening ? – steve Aug 22 '15 at 19:27
  • @ThomasOkken Please edit your question to add information. The first directive does not match You say you're coming from an IP address in the block, but isn't. Did you mean to write – Gilles Aug 22 '15 at 20:30

Your netmaks are incorrect. If you want to include private networks, you should use :,,

This is probably why you do not match, rather than a ssh bug.


I was answering similar question on Superuser.com, but after the responses I am not longer sure if it is right.

In short, I believe that it is currently not possible and even openssh-7.0 is out, but these bugs were not fixed so we will have to urge upstream.

Also there is alternative answer with positive feedback, but I guess this is the way how you are trying to achieve your results. I didn't try it, but this looks like it is related only for groups. Otherwise match *,!something doesn't make much sense.

Not to blame upstream all the way here and not bringing any constructive feedback, I can recommend you to run two separate sshd services on different ports. One would user AllowGroup sftp and force sftp server. The other would answer only to requests from you internal network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.