Bug 2391

Our customer got into problems using AllowGroup in combination with AllowUsers, because documentation in this part is little bit unclear.

Original problem is that when you use AllowUsers in combination with AllowGroups, only users who are specified in AllowUsers AND some of their group is in AllowGroups can login.

Minimal test case:
/etc/ssh/sshd_config
>AllowUsers user
>AllowGroups user
user:user can log in

/etc/ssh/sshd_config
>AllowUsers user
>AllowGroups othergroup
user:user can NOT log in

/etc/ssh/sshd_config
>AllowUsers otheruser
>AllowGroups user
user:user can NOT log in


Manual page states:
> ".. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups."
There is not mentioned what happens, if you succeed with User. If the chain continues to Groups tests or not. This should be clear not to confuse users.

In spite of all the other bugs related to similar issue (#2292, #1690) I would say that this should be properly documented. Changes in evaluation can be pretty dangerous.

Customer propose to mention this exact use case:
>If both AllowGroups and AllowUsers are specified, both must succeed before login is allowed.

My proposal is more generic. I would append such a sentence after above mentioned quote:
> All of the user and group tests must succeed, before user is allowed to login.

If I don't miss something, this should explain it little bit better and avoid further confusion.