---
title: "OpenSSH: Leveraging the Match Directive"
description: Learn how to enhance OpenSSH security with the Match directive, enabling fine-tuned user and host-based access controls for admins
image: https://codenotary.com/hubfs/preview-match.webp
---

**$ protect --distro linux --machines 25 --free**

[Start now](https://apps.codenotary.com/linux)

[![cn-logo-black-nobg](https://codenotary.com/hubfs/cn-logo-black-nobg.svg)](https://codenotary.com/)

- Product
  
  #### [![AgentMon Start](https://codenotary.com/hubfs/chub_backup/AgentMon%20Start.svg) **AgentMon Start** See what your AI agents are doing on your machine. TRY NOW →](https://codenotary.com/agentmon-start)
  
  #### [![AgentMon for Enterprise](https://codenotary.com/hubfs/AgentMon%20for%20Enterprise.svg) **AgentMon** Currently monitors more \> 7 million agent interactions/day. TRY NOW →](https://codenotary.com/agentmon)
  
  #### [![AgentX](https://codenotary.com/hubfs/AgentX.svg) **AgentX** Agentic network control middleware. TRY NOW →](https://codenotary.com/agent-network-control)
  
  #### [![Autonomous Security](https://codenotary.com/hubfs/Autonomous%20Security.svg) **Autonomous Security** AI Agents keep your servers secure. TRY NOW →](https://codenotary.com/trust)
- Use Cases
  
  #### [**AI Agent Risk Monitoring** Continuous oversight of autonomous agents across every environment.](https://codenotary.com/use-cases#risk)
  
  #### [**Autonomous Security Operations** Self-healing defenses that detect, contain, and remediate threats.](https://codenotary.com/use-cases#agentops)
  
  #### [**AI Coding Governance & Performance Monitoring** AI-generated code reviewed, tracked, and held to quality standards.](https://codenotary.com/use-cases#performance)
  
  #### [**AI Tool Cost & Usage Optimization** Spend and consumption optimized across every AI service in use.](https://codenotary.com/use-cases#cost)
  
  #### [**AI Tool Security & Policy Enforcement** Approved AI usage enforced with guardrails and policy controls.](https://codenotary.com/use-cases#security#security)
  
  #### [**Shadow AI Governance** Unsanctioned AI tools discovered, surfaced, and brought under control.](https://codenotary.com/use-cases#shadowit)
- [Blog](https://codenotary.com/blog)
- [Press](https://codenotary.com/press)
- Resources
  
  #### [**Integrations** Connect with your favorite tools and platforms. LEARN MORE →](https://codenotary.com/integrations)
  
  #### [**Support** Get help from our dedicated support team. GET HELP →](https://support.codenotary.com)
  
  #### [**Success Stories** Read how customers achieve their goals. READ MORE →](https://codenotary.com/success)
  
  #### [**Learn** Access documentation and learning resources. EXPLORE →](https://codenotary.com/learn)

[Login](https://apps.codenotary.com/auth/login)

[All posts](https://codenotary.com/blog/all)

 Mar 13, 2024

# OpenSSH: Leveraging the Match Directive

 By  [blog](https://codenotary.com/blog/author/blog)  ·   2 minute read

As an administrator, I find OpenSSH to be an invaluable tool for managing remote logins securely using the SSH protocol. One feature that often goes overlooked is the Match directive, which offers a powerful way to customize user permissions and access controls within the OpenSSH server configuration. 

In this post, I'll explore how to effectively use the Match directive to enhance both the security and usability of the OpenSSH server.

![CN-Assets (17)](https://codenotary.com/hs-fs/hubfs/CN-Assets%20(17).png?width=6912&height=3456&name=CN-Assets%20(17).png)

## Understanding the Match Directive

The Match directive allows us to apply specific settings conditionally based on attributes such as username, group, hostname, or IP address. When a Match condition is met, the configurations specified within that block take precedence over the global settings in sshd\_config until the end of the file or the next Match block.

This feature is particularly useful for implementing tailored access controls without the need for multiple SSH server instances or complex firewall rules.

## Practical Examples

Let's dive into some practical examples to illustrate how we can leverage the Match directive to control access based on user and source host.

### Example 1: Restricting User Access

Suppose I want to limit certain users to SFTP access only, disabling their shell access. This is common in environments where users need to securely transfer files but should not have full shell access to the server.

`Match User filetransferuser`  
`    ChrootDirectory /home/filetransferuser`  
`    ForceCommand internal-sftp`  
`    AllowTcpForwarding no`  
`    X11Forwarding no`

In this example, the user '`filetransferuser`' is chrooted to their home directory and can only use SFTP. TCP and X11 forwarding are disabled for added security.

### Example 2: Permitting Access from Specific Hosts

In another scenario, I might want to restrict SSH access to connections from a specific IP address or subnet, enhancing security by limiting where login attempts can originate.

`Match User secureuser Address 192.168.1.0/24`  
`    PermitRootLogin no`  
`    AllowTcpForwarding yes`  
`    X11Forwarding yes`

Here, '`secureuser`' is only allowed SSH access if they connect from an IP address within the 192.168.1.0/24 subnet.

### Example 3: Combining User and Host Restrictions

The Match directive truly shines when I combine multiple criteria, offering granular control over access permissions.

`Match User adminuser Address 10.10.10.5`  
`    PermitRootLogin yes`  
`    AllowTcpForwarding no`

In this configuration, '`adminuser`' logging in from 10.10.10.5 can use the root account, but TCP forwarding is disabled. This setup might be suitable for administrative tasks from a known, secure location.

## How to End a Match Directive Block

In the OpenSSH configuration file (sshd\_config), a Match block continues until the next Match directive or the end of the file. There's no need to explicitly "close" a Match block with a specific statement. I can simply start a new section or end your modifications.

To finish a Match block and return to applying the global settings for subsequent lines, you would either:

\- Start another Match block with different conditions.   
\- Continue with global settings if you've completed your conditional configurations.

## Final Thoughts

The Match directive in OpenSSH offers a flexible and robust way to customize access controls, making it an essential tool for administrators concerned with securing their servers. By applying the scenarios outlined above, we can significantly enhance the security and manageability of SSH access. But don't forget to thoroughly test any changes to your SSH server before deploying them to production environments.

[![Share on twitter](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/twitter-color.png?width=35&height=35&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://codenotary.com/blog/openssh-leveraging-the-match-directive&utm_medium=social&utm_source=twitter&url=https://codenotary.com/blog/openssh-leveraging-the-match-directive&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on facebook](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/facebook-color.png?width=35&height=35&name=facebook-color.png)](http://www.facebook.com/share.php?u=https://codenotary.com/blog/openssh-leveraging-the-match-directive&utm_medium=social&utm_source=facebook) [![Share on linkedin](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/linkedin-color.png?width=35&height=35&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://codenotary.com/blog/openssh-leveraging-the-match-directive&utm_medium=social&utm_source=linkedin) [![Share on pinterest](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/pinterest.jpg?width=35&height=35&name=pinterest.jpg)](http://pinterest.com/pin/create/button/?url=https://codenotary.com/blog/openssh-leveraging-the-match-directive&utm_medium=social&utm_source=pinterest&media=)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "blog",
    "url" : "https://codenotary.com/blog/author/blog"
  },
  "dateModified" : "2024-03-13T12:44:44.193Z",
  "datePublished" : "2024-03-13T12:44:44.000Z",
  "headline" : "OpenSSH: Leveraging the Match Directive",
  "image" : [ "https://codenotary.com/hubfs/preview-match.webp" ],
  "mainEntityOfPage" : {
    "@id" : "https://codenotary.com/blog/openssh-leveraging-the-match-directive",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://codenotary.com/hubfs/logo-light.svg"
    },
    "name" : "Codenotary, Inc."
  }
}
```

```json
{
  "@context" : "http://schema.org",
  "@type" : "Article",
  "author" : {
    "@type" : "Person",
    "name" : [ "blog" ],
    "url" : "https://codenotary.com/blog/author/blog"
  },
  "datePublished" : "2024-03-13T12:44:44+0000",
  "description" : "Learn how to enhance OpenSSH security with the Match directive, enabling fine-tuned user and host-based access controls for admins",
  "headline" : "OpenSSH: Leveraging the Match Directive",
  "image" : "https://23873599.fs1.hubspotusercontent-na1.net/hubfs/23873599/preview-match.webp",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://cdn2.hubspot.net/hubfs/23873599/logo-light.svg"
    },
    "name" : ""
  },
  "url" : "https://codenotary.com/blog/openssh-leveraging-the-match-directive"
}
```