1

Given an openssh (1:7.2p2-4ubuntu2.6 on ubuntu 16.04) installation, I find myself with multiple tiers of groups that I'd like to work with. The way I'm trying to set up the groups is effectively this:

  • Port-forwarding
    1. Forward to local ports only
    2. Above, plus a few remote ports
    3. Forward "any" port
  • Access
    1. SFTP-only (e.g., ForceCommand internal-sftp), chrooted
    2. SFTP-only, not chrooted
    3. Full shell access

I'll use groups named unimaginatively pf1, pf2, pf3, and acc1, acc2, acc3, respectively.

The way the man page words it

If a keyword appears in multiple Match blocks that are satisfied, only the first instance of the keyword is applied.

it sounds like the only way to do this is effectively

Match Group pf1,acc1
  PermitOpen localhost:1234 localhost:2345
  ForceCommand internal-sftp
  ChrootDirectory /somepath
Match Group pf1,acc2
  PermitOpen localhost:1234 localhost:2345
  ForceCommand internal-sftp
Match Group pf1,acc3
  PermitOpen localhost:1234 localhost:2345

Match Group pf2,acc1
  PermitOpen localhost:1234 localhost:2345 remote1:1234 remote2:2345
  ForceCommand internal-sftp
  ChrootDirectory /somepath
Match Group pf2,acc2
  PermitOpen localhost:1234 localhost:2345 remote1:1234 remote2:2345
  ForceCommand internal-sftp
Match Group pf1,acc3
  PermitOpen localhost:1234 localhost:2345 remote1:1234 remote2:2345

Match Group pf3,acc1
  #PermitOpen any
  ForceCommand internal-sftp
  ChrootDirectory /somepath
Match Group pf2,acc2
  #PermitOpen any
  ForceCommand internal-sftp
Match Group pf1,acc3
  #PermitOpen any

I could possibly save a couple lines by defaulting to one set of PermitOpen and such, but it doesn't remove the need to iterate through every possible combination of the two sets of groups with disparate types of restrictions. If there are any other special-cases (these three users have one special need), then I need to multiply the number of their distinct groups ...

I know the config doesn't seem to allow this, but am I missing something or is it really this literal and enumerative?

Ultimately I'd just want to use something that lets me do a more additive approach:

Match Group pf1
  PermitOpen localhost:1234 localhost:2345
Match Group pf2
  PermitOpen localhost:1234 localhost:2345 remote1:1234 remote2:2345
Match Group pf3
  #PermitOpen any
Match Group acc1
  ForceCommand internal-sftp
  ChrootDirectory /somepath
Match Group acc2
  ForceCommand internal-sftp
Match Group acc3
  # not needed

for readability as well as ease of configuration.

Background searches:

  • the mailing list does not turn up much over the last couple of years, I might need to expand my search parameters (this is just one set of searches)
  • not quite related: How to exclude from a "Match Group" in SSHD?
  • I believe dropbear does not support this level of precise control

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.