List SSH Allow and Deny Rules

You need to find SSH allow-list and deny-list directives across the main config and include files.

Command

grep -RhnE '^(AllowUsers|AllowGroups|DenyUsers|DenyGroups|Match )' etc/ssh

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not remove allow or deny rules from this output alone; confirm group membership, Match context, and operational ownership first.

Expected output

Line-numbered SSH access directives from sshd_config and included files.

System impact

Read-only, sensitive output. Nothing changes. The command searches fixture-local SSH config files and prints matching access directives with file and line numbers.

Recovery / rollback: no state is changed.

When to use it

Use during access reviews, server handoffs, or when a user can authenticate but still cannot open an SSH session.

When not to use it

Do not remove allow or deny rules from this output alone; confirm group membership, Match context, and operational ownership first.

Watch this command run

Command transcript

This sanitized transcript shows the commands and output shape without exposing host details.

demo@lab:~$

$ find etc/ssh -type f -print | sort

etc/ssh/sshd_config
etc/ssh/sshd_config.d/access.conf

$ grep -RhnE '^(AllowUsers|AllowGroups|DenyUsers|DenyGroups|Match )' etc/ssh

1:DenyUsers test oldadmin
2:AllowGroups ssh-login deployers
6:AllowUsers alice deploy
8:Match Address 198.51.100.0/24

View commands shown

These are the commands shown in the sanitized transcript.