2

I'm having an issue with the exclusion of users from the match group statement of my sshd configuration.

I already have a user exclusion declared like this

Match Group sftpusergroup User *,!"sftp_user"

This only started to work after I've put the user inside "", I suspect it is because of the _ on the username.

Now I need to add a second user to this exclusion but when I do it all the users get the following error while trying to connect to the server

16:23:56 Error: Network error: Connection refused

16:23:56 Error: Could not connect to server

I've added the second exclusion using

Match Group sftpusergroup User *,!"sftp_user",!"sftp_user_2"

Also tried to make it with

Match Group sftpusergroup User *,!"sftp_user",!sftp_user_2

But always with the same result. Has anyone experienced this behavior before?

Improve this question
1
  • A quick browse through the sources of openssh 7.2 (which might not be what you are using) would seem to suggest you only need quotes when your argument has spaces. The line is basically split on whitespace into parts and only an entire part can be quoted. So you might have Match user "*,!a b,x" but not Match user *,!"a b",x. In any case, you shouldn't need quotes in your example since there is no whitespace. Run sshd -d to get debug output.
    – meuh
    Nov 30, 2017 at 19:24

1 Answer 1

Reset to default
6

I haven't seen this behaviour before, but looking at the man ssh_config I see:

A pattern-list is a comma-separated list of patterns. Patterns within pattern-lists may be negated by preceding them with an exclamation mark ('!'). For example, to allow a key to be used from anywhere within an organisation except from the ''dialup'' pool, the following entry (in authorized_keys) could be used:

from="!.dialup.example.com,.example.com"

Perhaps this will work:

Match Group sftpusergroup User "*,!sftp_user,!sftp_user_2"

by putting the entire user list in quotes.

Improve this answer
1
  • 3
    Thank you sapensadler. that solved the issue. lesson learned, don't give up on reading man pages a little bit more :)
    – BANJOSA
    Nov 30, 2017 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.