In Centos 7, What should our sshd_config look like to: Deny Root AND Allow Specific Users(not in group) on internal subnet, AND Allow Groups from external? Question is very specific!
Result we want: External ssh/sftp connections for our customers to land in their own Home/Root directories specific to them. But do not want employees to access from external, only from internal subnet. Because employees have greater access to folder structures.
These are the configs we have been using, but they do not work nor do they make sense as the documentation does not elaborate enough.
1.This Config should allow bob and trev internally, and allow sftpgroup. Instead it Allows the sftpgroup but does not allow other users: (bob trev are not in the group)
Match Address 192.168.1.0/24
AllowUsers bob trev
Match All
AllowGroups sftpgroup
PermitRootLogin no
Documentation says these commands are processed in this order: DenyUsers, AllowUsers, DenyGroups AllowGroups.
2.So if they are processed in this order then the below should work but it does not (bob and trev have no access), so what is the point of ordered processing, if the later command does not overide the previous. shouldn't it Deny All and then allow specific users. but it does not. I feel like either this is buggy or the documentation is incomplete.:
DenyUsers *
Match Address 192.168.1.0/24
AllowUsers bob trev
Match All
PermitRootLogin no
The Match Address Command works I have tested it.