When I run
sudo dscl . -append /Groups/com.apple.access_ssh GroupMembership $USERNAME
append: Invalid Path <dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)
I just looked at my copy of Mountain Lion and the com.apple.access_ssh group doesn't exist until you've actually turned on "Remote Login" in System Preferences.
When you turn on Remote Desktop AND set it to "Allow access for: Only these users", then there is a group called "com.apple.access_ssh". When you set it back to ""Allow access for: All users", the name of the group is changed to "com.apple.access_ssh-disabled".
Here’s how you can add groups to your SSH access list (aka a SACL). All commands must be run with root privileges:
Command to create the SACL (if it doesn’t already exist):
Add your group as a nested group inside the SACL group:
If you’re adding an AD group, you may need to add the AD domain’s name: