OpenSSH evaluates access-control keywords in a fixed order: DenyUsers → AllowUsers → DenyGroups → AllowGroups. All of these tests must pass before a session is permitted. Therefore, if a username matches test it is rejected immediately by DenyUsers, even when the account is a member of an allowed group. Conversely, usernames that do not match the pattern must still satisfy AllowGroups; the directive accepts anyone whose primary or supplementary group list includes admins. Supplementary-group membership is explicitly checked, so restricting evaluation to the primary GID is incorrect. The two directives are perfectly valid together and will not prevent sshd from starting.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is OpenSSH's evaluation order for access-control keywords?
Open an interactive chat with Bash
Does the AllowGroups directive include supplementary groups?
Open an interactive chat with Bash
Why do DenyUsers and AllowGroups coexist without issues in sshd_config?
Open an interactive chat with Bash
CompTIA Linux+ XK0-006 (V8)
Security
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access