i'm trying to manage access for ssh with AllowGroups, and it's working fine. Now i would like to restrict access to some groups only if they connect from a specific host, with AllowUsers it works like user@ but in AllowGroups isn't working.


AllowGroups itstaff securitystaff@

I have tried using Match Address and AllowGroups inside but it seems that AllowGroups is not allowed within a Match Block.

Match Address "" AllowGroups securitystaff

sshd service fails to start and i get the message "Directive AllowGroups is not allowed within a match block.

Thanks in advance for any ideas.

  • Possible duplicate: serverfault.com/questions/326100/… Please see the answers posted there. – slowko Jan 3 '17 at 16:32
  • The general rule of thumb for authentication is for the program to use PAM and only implement access controls that pertain to the application's purpose or internal function. For generally useful things like locking groups down to subnets, chances are that there exists a PAM module to do whatever specific thing you want. Most daemons don't re-invent the wheel and will just tell you to use the relevant PAM module(s) for setting the specific policy that you're after. In this case pam_access is what you're after. – Bratchley Jan 3 '17 at 17:56
  • Posted that as a comment since there's no real way to answer this question as it's written since it's neither possible or advisable. – Bratchley Jan 3 '17 at 17:57
  • Thanks, from what i've read that means that i should put something like: – Diego Dasso Jan 4 '17 at 17:04
  • AllowGroups itstaff securitystaff (in sshd_conf) and + : securitystaff : - : securitystaff : ALL (in /etc/security/access.conf) Is it necessary that i put itstaff too on access.conf? – Diego Dasso Jan 4 '17 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.