CentOS - Feb 2017 - sshd Match Group directive problem

I try to set up two "Match Group" directives in sshd_config.

I have an LDAP server.  All users including admins are part of the LDAP
group users. The admins users are also part of the LDAP group wheel. For
example:

[~]groups admin1
admin1 : users wheel
[~]groups users
user1 : users

On a client server to LDAP, I try to configure two "Match Group"
directives
in sshd_config as follows:

Match Group wheel
    some keywords...

Match Group users
    some keywords...


The problem is that even if a user is a member of LDAP group wheel, the
"Match Group wheel" directive is skipped in favor of the "Match
Group
users" directive.

Is it possible to have two "Match Group" directives as I like to do
it?  If
yes, what is wrong in my configuration?

Thanks,

A detail I forgot...

The need is to have members of the groups wheel and users being dropped to
a shell and administer the server while members of only the group users
have a script started forcing them to a few command on the server.



On Tue, Feb 28, 2017 at 10:50 AM, Bernard Fay <bernard.fay at gmail.com>
wrote:
> I try to set up two "Match Group" directives in sshd_config.
>
> I have an LDAP server.  All users including admins are part of the LDAP
> group users. The admins users are also part of the LDAP group wheel. For
> example:
>
> [~]groups admin1
> admin1 : users wheel
> [~]groups users
> user1 : users
>
> On a client server to LDAP, I try to configure two "Match Group"
> directives in sshd_config as follows:
>
> Match Group wheel
>     some keywords...
>
> Match Group users
>     some keywords...
>
>
> The problem is that even if a user is a member of LDAP group wheel, the
> "Match Group wheel" directive is skipped in favor of the
"Match Group
> users" directive.
>
> Is it possible to have two "Match Group" directives as I like to
do it?
> If yes, what is wrong in my configuration?
>
> Thanks,
>
>

> Am 28.02.2017 um 17:02 schrieb Bernard Fay <bernard.fay at
gmail.com>:
> 
> A detail I forgot...
> 
> The need is to have members of the groups wheel and users being dropped to
> a shell and administer the server while members of only the group users
> have a script started forcing them to a few command on the server.
> 

man sshd_config:  The match patterns may consist of single entries or
comma-separated lists ...

 Match Group wheel,users 

--
LF