i'm trying to manage access for ssh with AllowGroups, and it's working fine. Now i would like to restrict access to some groups only if they connect from a specific host, with AllowUsers it works like [email protected] but in AllowGroups isn't working.


AllowGroups itstaff [email protected]

I have tried using Match Address and AllowGroups inside but it seems that AllowGroups is not allowed within a Match Block.

Match Address "" AllowGroups securitystaff

sshd service fails to start and i get the message "Directive AllowGroups is not allowed within a match block.

Thanks in advance for any ideas.

  • Possible duplicate: serverfault.com/questions/326100/… Please see the answers posted there.
    – slowko
    Commented Jan 3, 2017 at 16:32
  • The general rule of thumb for authentication is for the program to use PAM and only implement access controls that pertain to the application's purpose or internal function. For generally useful things like locking groups down to subnets, chances are that there exists a PAM module to do whatever specific thing you want. Most daemons don't re-invent the wheel and will just tell you to use the relevant PAM module(s) for setting the specific policy that you're after. In this case pam_access is what you're after.
    – Bratchley
    Commented Jan 3, 2017 at 17:56
  • Posted that as a comment since there's no real way to answer this question as it's written since it's neither possible or advisable.
    – Bratchley
    Commented Jan 3, 2017 at 17:57
  • Thanks, from what i've read that means that i should put something like: Commented Jan 4, 2017 at 17:04
  • AllowGroups itstaff securitystaff (in sshd_conf) and + : securitystaff : - : securitystaff : ALL (in /etc/security/access.conf) Is it necessary that i put itstaff too on access.conf? Commented Jan 4, 2017 at 17:11

1 Answer 1


I've experimented many times and finally found how to make it work.

First, outside any match block set the groups you always want to allow access from:

AllowGroups staff

Then inside a match block restrict another group's access by IP address/network:

Match Group group1 Address
    AllowGroups *

AllowGroups * is important. AllowUsers * doesn't work here.

This results in allowing group staff from anywhere, and group group1 only from Enjoy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .