openssh unix dev - May 2011 - Possible error in coding of AllowUsers / AllowGroups in ssh 5.8p2

What I was trying to do:
I wanted to use the AllowGroups facility to allow users in by group instead of
listing individual usernames but also allow root only from a single central
host.

Setup actions:
targetusername on target host has a secondary group entry of "staff".
Updated sshd_config to add the lines:
    AllowUsers root at nimsrvr
    AllowGroups staff
targertusername is NOT listed in AllowUsers

Stopped and started sshd

Attempted to ssh from another host as "ssh targetusername at targethost
date"

I always get the syslog message "user X from Y not allowed because not
listed in AllowUsers.

The possible error (as I see it):  The man page reads as if I should be able to
specify a groupname or list of groupnames without having to specify a list of
usernames.  (it should be treated as an "or" condition).  The way that
I read the code in "auth.c" is:
  If the  AllowUsers  option is present, check the  targetusername against the
AllowedUsers list.  If it is not in the list, return false (which appears to
reject the login).  Only if the targetusername is in the AllowUsers list will
the code then check the AllowGroups list.

It appears that the code treats the AllowUsers / AllowGroups as an
"and" condition rather than an "or" condition as the man
page implies.

So either the code needs to change or the man page needs to change to be more
explicit on the processing of the parameters. :)

Kent Wick
512 867 7325
Unix System Admin