Match multiple users in 'sshd_config'

Question

I'm trying to apply the same sshd settings to multiple users.

According to the manual, it seems Match User acts like an AND:

Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file

How do I state "for any of these users...", so in this example bob, joe, and phil are allowed to use SSH as a proxy, but not allowed to log in:

Match User bob, User joe, User phil
    PasswordAuthentication yes
    AllowTCPForwarding yes
    ForceCommand /bin/echo 'We talked about this guys. No SSH for you!'

score 41 · Accepted Answer · edited Mar 17 '17 at 13:14

41

Not having done this myself, I can only go on what the manuals say:

From the sshd_config manual:

The match patterns may consist of single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS section of ssh_config(5).

This means that you ought to be able to say

Match User bob,joe,phil
  PasswordAuthentication yes
  AllowTCPForwarding yes
  ForceCommand /bin/echo 'We talked about this guys. No SSH for you!'

See also this answer on the Information Security forum: https://security.stackexchange.com/a/18038

edited Mar 17 '17 at 13:14

Community

1

answered Feb 12 '17 at 18:43

Kusalananda

320,670
36
633
936

9

Important detail, no spaces between the users (eg. after the comma) are allowed – Manuel Manhart Jun 30 '19 at 17:00
2

@ManuelManhart No, exactly, the names are supposed to be comma-separated, as mentioned in he manual. – Kusalananda Jun 30 '19 at 23:19

score 7 · Answer 2 · answered Feb 12 '17 at 18:31

7

Use the Match directive on a group instead of a user. Then add the users to that group

Match Group users_with_no_ssh
    PasswordAuthentication yes
    AllowTCPForwarding yes
    ForceCommand /bin/echo 'We talked about this guys. No SSH for you!'

answered Feb 12 '17 at 18:31

tomodachi

189
3

score 2 · Answer 3 · answered Jan 29 '19 at 21:53

I'm not sure ForceCommand would work well with SFTP. Also, maybe it's better to see 'DenyUsers' word in logs. Anyway, I use this (well, maybe it would be better to use Group):

sshd_config

# support, ansible & backup only from specific IP                                                                    
Match User ansible,backup,support Address *,!176.x.x.x                                                          
      DenyUsers ansible,backup,support

Match User backup
        AllowTcpForwarding yes
        AllowAgentForwarding yes
        PermitListen 127.0.0.1:2223
        AcceptEnv RESTIC_REPOSITORY RESTIC_PASSWORD

Testing configuration

# sshd -T -C addr=176.x.x.x,user=backup | egrep '^((deny|allow)users|permitlisten|acceptenv)'
denyusers root
acceptenv RESTIC_REPOSITORY
acceptenv RESTIC_PASSWORD
permitlisten 127.0.0.1:2223

# sshd -T -C addr=8.8.4.4,user=backup | egrep '^((deny|allow)users|permitlisten|acceptenv)' 
denyusers ansible,backup,support
acceptenv RESTIC_REPOSITORY
acceptenv RESTIC_PASSWORD
permitlisten 127.0.0.1:2223

Real world test

Jan 29 16:50:12 mx1 sshd[71309]: Connection from 199.x.x.x port 21042 on 199.x.x.x port 2222 rdomain "0"   
Jan 29 16:50:13 mx1 sshd[71309]: User support from 199.x.x.x not allowed because listed in DenyUsers
Jan 29 16:50:13 mx1 sshd[71309]: Connection closed by invalid user support 199.x.x.x port 21042 [preauth]

ForceCommand works on sftp too. That is how we enable Duo 2fa within our organization. — Edward Ned Harvey, Feb 24 '21 at 20:50

Match multiple users in 'sshd_config'

3 Answers3