Excluding users from Match Group on SSH

Question

I'm having an issue with the exclusion of users from the match group statement of my sshd configuration.

I already have a user exclusion declared like this

Match Group sftpusergroup User *,!"sftp_user"

This only started to work after I've put the user inside "", I suspect it is because of the _ on the username.

Now I need to add a second user to this exclusion but when I do it all the users get the following error while trying to connect to the server

16:23:56 Error: Network error: Connection refused

16:23:56 Error: Could not connect to server

I've added the second exclusion using

Match Group sftpusergroup User *,!"sftp_user",!"sftp_user_2"

Also tried to make it with

Match Group sftpusergroup User *,!"sftp_user",!sftp_user_2

But always with the same result. Has anyone experienced this behavior before?

Answer 1

I haven't seen this behaviour before, but looking at the man ssh_config I see:

A pattern-list is a comma-separated list of patterns. Patterns within pattern-lists may be negated by preceding them with an exclamation mark ('!'). For example, to allow a key to be used from anywhere within an organisation except from the ''dialup'' pool, the following entry (in authorized_keys) could be used:

from="!.dialup.example.com,.example.com"

Perhaps this will work:

Match Group sftpusergroup User "*,!sftp_user,!sftp_user_2"

by putting the entire user list in quotes.