openssh unix dev - May 2017 - sshd_config : negation in Match blocks

Hi,

I want to come to a specific behavior described in
https://access.redhat.com/solutions/289073

For example, taking an user who is NOT a member of a group *-foo

Match Group !*-foo
=> this won't match

Match Group *,!*-foo
=> this will match

I would expect the first to match too, intuitively.

I'm unsure if this behavior is expected, and if not, if it has a
corresponding bug report : is it that one ?
https://bugzilla.mindrot.org/show_bug.cgi?id=1918

(I'm running 7.2p2-4ubuntu2.1)

Regards,

Hi,

Might it be the wrong place for this question ?
Or is it considered as minor because a workaround exists ?

Thanks !

Regards,

Le 19/05/2017 ? 11:38, mh at ow2.org a ?crit :
> Hi,
> 
> I want to come to a specific behavior described in
> https://access.redhat.com/solutions/289073
> 
> For example, taking an user who is NOT a member of a group *-foo
> 
> Match Group !*-foo
> => this won't match
> 
> Match Group *,!*-foo
> => this will match
> 
> I would expect the first to match too, intuitively.
> 
> I'm unsure if this behavior is expected, and if not, if it has a
> corresponding bug report : is it that one ?
> https://bugzilla.mindrot.org/show_bug.cgi?id=1918
> 
> (I'm running 7.2p2-4ubuntu2.1)
> 
> Regards,
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>

There are some bugs for this:

https://bugzilla.mindrot.org/show_bug.cgi?id=2397
https://bugzilla.mindrot.org/show_bug.cgi?id=1918

I tried to fix it once, but the obvious fix had non-obvious corner
cases.

On Wed, 24 May 2017, mh at ow2.org wrote:
> Hi,
> 
> Might it be the wrong place for this question ?
> Or is it considered as minor because a workaround exists ?
> 
> Thanks !
> 
> Regards,
> 
> Le 19/05/2017 ? 11:38, mh at ow2.org a ?crit :
> > Hi,
> > 
> > I want to come to a specific behavior described in
> > https://access.redhat.com/solutions/289073
> > 
> > For example, taking an user who is NOT a member of a group *-foo
> > 
> > Match Group !*-foo
> > => this won't match
> > 
> > Match Group *,!*-foo
> > => this will match
> > 
> > I would expect the first to match too, intuitively.
> > 
> > I'm unsure if this behavior is expected, and if not, if it has a
> > corresponding bug report : is it that one ?
> > https://bugzilla.mindrot.org/show_bug.cgi?id=1918
> > 
> > (I'm running 7.2p2-4ubuntu2.1)
> > 
> > Regards,
> > _______________________________________________
> > openssh-unix-dev mailing list
> > openssh-unix-dev at mindrot.org
> > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
> > 
> 
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>