2

I have got two groups in sshd_config:

    AllowGroups sftpusers sshusers

And I have two groups below subsystem sftp /usr/lib/openssh/sftp-server:

    Match Group sftpusers,!sshusers
    ForceCommand internal-sftp
    ChrootDirectory %h
    AuthorizedKeysFile %h/.ssh/authorized_keys
    AllowTcpForwarding no

So my intention is to allow all users within sftpusers group to use sftp, and all users within sshusers group are denied from using sftp.

But this Match Group restriction does not work. After reloading the ssh server, users from sshusers group still can login via sftp, which I do not want.

Indeed the Match Group has no function at all. No matter how I configure this line, the sshd service does not pay attention to it. I'm running Debian v7.6 amd64 with grsecurity hardened kernel on a DELL PowerEdge R720 dedicated server.

8
  • Have you tried running sshd in debug mode to get some feedback about the matching that is performed? Aug 8, 2014 at 9:39
  • The trouble, I don't want to lose connection from my server which is located some serveral hundres miles away from home. A single sshd-debug-session says: Set /proc/self/oom_score_adj from -1000 to -1000 debug1: Bind to port 22 on 0.0.0.0. Bind to port 22 on 0.0.0.0 failed: Address already in use. debug1: Bind to port 22 on ::. Bind to port 22 on :: failed: Address already in use. Cannot bind any address. Aug 8, 2014 at 9:51
  • 1
    Start a separate instance of SSH on a different port and keep that one open while you debug.
    – Jenny D
    Aug 8, 2014 at 10:03
  • I did and succeeded. But there were no enlightening debugging messages during debug session on alternative port 2222 after starting /usr/sbin/sshd -p 2222 -D -d -e. Aug 8, 2014 at 10:20
  • Multiple -d options increase the debugging level. Maximum is 3. Aug 8, 2014 at 12:17

0

You must log in to answer this question.

Browse other questions tagged .