This is a discussion on AllowUsers not working under certain conditions - openssh ; Hello, I've trawled archives looking for changes in the "AllowUsers" option, manuals, changes log, reported bugs and to my surprise I can't find anything or anyone that has reported the issues that I am experiencing. I am using the default ...
I've trawled archives looking for changes in the "AllowUsers" option,
manuals, changes log, reported bugs and to my surprise I can't find anything
or anyone that has reported the issues that I am experiencing.
I am using the default installation sshd_config file as supplied by Redhat
and the only options I have changed are:
The first problem exists on both of the following versions oppenssh-3.5p1
1) I have on one of our servers the line in the sshd_config file:
AllowUsers email@example.com.* firstname.lastname@example.org.*
The server that runs the sshd only allows ssh clients to connect from the
Where as one would expect it to allow connections from both the listed
sub-nets 192.168.100.0/24 and 192.168.102.0/24.
Basically if I try connecting from the 192.168.102.0/24 sub-net I get the
"User root not allowed because not listed in AllowUsers" error.
The weird thing here is that if I change the option:
then the problem goes away.
There appears to be nothing in the documentation that suggests the
ListenAddress setting effects the AllowUsers setting.
The second problem is not present on the oppenssh-3.5p1-6 but is present on
the later version oppenssh-3.9p1-8.
The problem has arisen after upgrading from Redhat Linux 9
(oppenssh-3.5p1-6) to Redhat Enterprise Linux 4 (oppenssh-3.9p1-8.RHEL4.1)
2) I have on one of our servers the line in the sshd_config file:
AllowUsers email@example.com root@*.mycompany.com firstname.lastname@example.org
User root can log on from the specified IP address or any domain which
matches the pattern *.mycompany.com. Note that the *.mycompany.com domains
are all machines on a local sub-net with their domain names specified in the
The user donald can connect from the local sub-net specified IP address but
cannot connect from an external domain that matches the pattern
*mydomain.com. The only way I can get the user donald to connect on the
external domain is by putting the exact IP address in the AllowUsers option,
which is not particularly useful as it is a dynamically changing IP address.
As I have already stated, the exact same AllowUsers option used to work fine
under the older (3.5p1) version of openssh.
I tried setting the option UseDNS to no but that makes no difference.
Can somebody tell me if these are known problems or simply features (that's
the way its supposed to work)?
If they are known or new problems are they likely to be fixed in the latest
Ps I particularly like the idea put forward by Patrick Gosling on 2005-01-20
10:27:17 titled: AllowUsers - proposal for useful variations on the theme
openssh-unix-dev mailing list