Yrurtj

Given an openssh (1:7.2p2-4ubuntu2.6 on ubuntu 16.04) installation, I find myself with multiple tiers of groups that I'd like to work with. The way I'm trying to set up the groups is effectively this:

• Port-forwarding
  
  
  
  
  1. Forward to local ports only
  
  
  2. Above, plus a few remote ports
  
  
  3. Forward "any" port
  
  
  
  


• Access
  
  
  
  
  1. SFTP-only (e.g., ForceCommand internal-sftp), chrooted
  
  
  2. SFTP-only, not chrooted
  
  
  3. Full shell access
  
  
  
  

I'll use groups named unimaginatively pf1, pf2, pf3, and acc1, acc2, acc3, respectively.

The way the man page words it

The arguments to Match are one or more criteria-pattern pairs or the single token All which matches all criteria.

it sounds like the only way to do this is effectively

Match Group pf1,acc1

  PermitOpen localhost:1234 localhost:2345

  ForceCommand internal-sftp

  ChrootDirectory /somepath

Match Group pf1,acc2

  PermitOpen localhost:1234 localhost:2345

  ForceCommand internal-sftp

Match Group pf1,acc3

  PermitOpen localhost:1234 localhost:2345



Match Group pf2,acc1

  PermitOpen localhost:1234 localhost:2345 remote1:1234 remote2:2345

  ForceCommand internal-sftp

  ChrootDirectory /somepath

Match Group pf2,acc2

  PermitOpen localhost:1234 localhost:2345 remote1:1234 remote2:2345

  ForceCommand internal-sftp

Match Group pf1,acc3

  PermitOpen localhost:1234 localhost:2345 remote1:1234 remote2:2345



Match Group pf3,acc1

  #PermitOpen any

  ForceCommand internal-sftp

  ChrootDirectory /somepath

Match Group pf2,acc2

  #PermitOpen any

  ForceCommand internal-sftp

Match Group pf1,acc3

  #PermitOpen any

I could possibly save a couple lines by defaulting to one set of PermitOpen and such, but it doesn't remove the need to iterate through every possible combination of the two sets of groups with disparate types of restrictions. If there are any other special-cases (these three users have one special need), then I need to multiply the number of their distinct groups ...

I know the config doesn't seem to allow this, but am I missing something or is it really this literal and enumerative?

Ultimately I'd just want to use something that lets me do a more additive approach:

Match Group pf1

  PermitOpen localhost:1234 localhost:2345

Match Group pf2

  PermitOpen localhost:1234 localhost:2345 remote1:1234 remote2:2345

Match Group pf3

  #PermitOpen any

Match Group acc1

  ForceCommand internal-sftp

  ChrootDirectory /somepath

Match Group acc2

  ForceCommand internal-sftp

Match Group acc3

  # not needed

for readability as well as ease of configuration.

Background searches:

• the mailing list does not turn up much over the last couple of years, I might need to expand my search parameters (this is just one set of searches)


• not quite related: How to exclude from a "Match Group" in SSHD?
  


• I believe dropbear does not support this level of precise control