Reflection for Secure IT for UNIX > Controlling Access and Authorization > Using Allow and Deny Keywords

Using Allow and Deny Keywords

The following keywords are available for controlling access to users, groups, and/or client host computers:

AllowUsers, DenyUsers, AllowGroups, DenyGroups, AllowHosts, DenyHosts, AllowTcpForwardingForUsers, DenyTcpForwardingForUsers, AllowTcpForwardingForGroups, DenyTcpForwardingForGroups, ForwardACL

You can specify users, groups, or hosts for any of these keywords by using a single instance of the keyword with a comma-separated list of values, or by including multiple instances of the keyword, in which case the final assigned value is cumulative over all instances.

The server uses the following logic to determine whether to allow a connection.

  1. Check to see if any "Deny" keywords are configured for a given access category (hosts, users, group, or TCP forwarding); and deny access if the client matches any denied expression.

  2. Check to see if any "Allow" keywords are configured for the same category.

    • If no "Allow" keywords are configured, access is granted.

    • If any "Allow" keywords are configured, the server allows access only if the client matches an allowed expression.

Examples

The following samples show how you can allow access, deny access, or use a combination of allow and deny.

To

Example

Allow access only to users whose name starts with "abc".

AllowUsers= abc.*

Deny access to client hosts with an IP address that begins with 123.156.78, and allow access to users on any other client.

DenyHosts=123\.156\.78\..*

Allow access to all hosts in the acme.com domain except badpc, and deny access to clients from any other domain.

AllowHosts=.*\.acme\.com

DenyHosts=badpc\.acme\.com

Deny access to all hosts in the acme.com domain, including mypc, and allow access to clients from any other domain.

DenyHosts=.*\.acme\.com

AllowHosts=mypc\.acme\.com

AllowHosts=.*

NOTE:Without the final line, no clients would be allowed access. This is because once any client is added to the allow list, clients are allowed access only if they match an allowed expression.

NOTE:You can also configure user-specific and host-specific settings using subconfiguration files.

Related Topics