DenyGroups

DenyGroups is a directive in the OpenSSH server configuration (sshd_config) that controls SSH login access based on group membership. It lists one or more group names, and any user who is a member of any of those groups is denied SSH access. The setting is commonly used to block access for specific teams, contractors, or service accounts without disabling the underlying user accounts.

Syntax and scope: DenyGroups groupname [groupname ...] accepts standard system group names defined in the group database (such as /etc/group). The check is performed for each login attempt, and if the user belongs to any of the specified groups, the authentication is rejected for SSH. DenyGroups affects SSH authentication methods supported by the server, including password, public key, and keyboard-interactive methods.

Usage and examples: For example, DenyGroups admins contractors interns would block any user who is a member of the admins, contractors, or interns groups from logging in via SSH. DenyGroups is often used in conjunction with other access-control directives such as AllowGroups or DenyUsers to refine who may connect.

Considerations: DenyGroups provides a targeted approach to restricting access without altering user accounts themselves. It applies only to SSH access and does not disable the user account for other services. When configuring access controls, administrators should ensure that legitimate users are not members of any denied groups and that overlapping rules are tested in a controlled environment.

See also: AllowGroups, DenyUsers, AllowUsers, sshd_config.