openssh bugs - Apr 2015 - [Bug 2391] New: Enhance AllowGroups documentation in man page

https://bugzilla.mindrot.org/show_bug.cgi?id=2391

            Bug ID: 2391
           Summary: Enhance AllowGroups documentation in man page
           Product: Portable OpenSSH
           Version: 6.8p1
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: Documentation
          Assignee: unassigned-bugs at mindrot.org
          Reporter: jjelen at redhat.com

Our customer got into problems using AllowGroup in combination with
AllowUsers, because documentation in this part is little bit unclear.

Original problem is that when you use AllowUsers in combination with
AllowGroups, only users who are specified in AllowUsers AND some of
their group is in AllowGroups can login.

Minimal test case:
/etc/ssh/sshd_config
>AllowUsers user
>AllowGroups user
user:user can log in

/etc/ssh/sshd_config
>AllowUsers user
>AllowGroups othergroup
user:user can NOT log in

/etc/ssh/sshd_config
>AllowUsers otheruser
>AllowGroups user
user:user can NOT log in


Manual page states:
> ".. The allow/deny directives are processed in the following order:
DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups."
There is not mentioned what happens, if you succeed with User. If the
chain continues to Groups tests or not. This should be clear not to
confuse users.

In spite of all the other bugs related to similar issue (#2292, #1690)
I would say that this should be properly documented. Changes in
evaluation can be pretty dangerous.

Customer propose to mention this exact use case:
>If both AllowGroups and AllowUsers are specified, both must succeed before
login is allowed.
My proposal is more generic. I would append such a sentence after above
mentioned quote:
> All of the user and group tests must succeed, before user is allowed to
login.
If I don't miss something, this should explain it little bit better and
avoid further confusion.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.