1

I have the following at the bottom of a usual /etc/ssh/sshd_config

Match Group sftpg                                                                                                                                                                                           
     ChrootDirectory /data/%u                                                                                                                                                                               
     ForceCommand internal-sftp                                                                                                                                                                             

# Personal settings                                                                                                                                                                                         
AllowUsers user1                                                                                                                                                                                           
AllowGroups user1                                                                                                                                                                                          
PermitRootLogin no 

There are no other AllowUsers entries in this file and there are no other sshd configs at least under the /etc/ssh directory.

Despite this, user2 can still log in via ssh. I have fully restarted the computer.

Shouldn't ssh be denied for every user not in AllowUsers? What can I try?

id user2 returns:

uid=1002(user2) gid=1002(user2) groups=1002(user2),115(nopasswdlogin),999(docker)
3
  • Add the id user2 output to the question ? And confirm nothing in /etc/ssh/sshd_config.d that's conflicting/overriding the main sshd_config file ?
    – steve
    Commented Jan 4, 2020 at 21:01
  • Do you have another line with [AllowUsers user2] ?
    – Philippe
    Commented Jan 4, 2020 at 22:45
  • Is user2 a member of group user1? Note the order in which sshd processes the directives: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.
    – gogoud
    Commented Jan 5, 2020 at 7:45

2 Answers 2

1

The documentation for the configuration file (see man sshd_config) talks about Match blocks like this (my emphasis),

Match Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.

It also says that,

Only a subset of keywords may be used on the lines following a Match keyword. Available keywords are [...] AllowGroups, [...] AllowUsers, [...] PermitRootLogin, [...]

So what's happening is that your AllowGroups, AllowUsers, and PermitRootLogin keywords are all being applied only when the Match Group sftpg block is in effect. It's like you've written it like this:

Match Group sftpg                                                                                                                                                                                           
    ChrootDirectory /data/%u                                                                                                                                                                               
    ForceCommand internal-sftp                                                                                                                                                                             
    AllowUsers user1                                                                                                                                                                                           
    AllowGroups user1                                                                                                                                                                                          
    PermitRootLogin no

The solution is to move your global settings above the first Match block so that they apply everywhere.

0

Move your #Personal section above Match Group/Match User section and bounce sshd. I had the same issue with AllowUsers under Match User.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .