I have got two groups in sshd_config:
AllowGroups sftpusers sshusers
And I have two groups below subsystem sftp /usr/lib/openssh/sftp-server:
Match Group sftpusers,!sshusers
ForceCommand internal-sftp
ChrootDirectory %h
AuthorizedKeysFile %h/.ssh/authorized_keys
AllowTcpForwarding no
So my intention is to allow all users within sftpusers group to use sftp, and all users within sshusers group are denied from using sftp.
But this Match Group restriction does not work. After reloading the ssh server, users from sshusers group still can login via sftp, which I do not want.
Indeed the Match Group has no function at all. No matter how I configure this line, the sshd service does not pay attention to it. I'm running Debian v7.6 amd64 with grsecurity hardened kernel on a DELL PowerEdge R720 dedicated server.