A Match block in sshd_config overrides settings for a given user, group or source address, so the file's top section may not describe what a particular person gets. Run sshd -T with -C connection parameters to print the effective configuration for that case, and use sshd -t to validate edits before reloading.
What Match does
The sshd_config manual says a Match line starts a conditional block. If all criteria on the line are satisfied, the keywords that follow override the global section until the next Match line or the end of the file. If a keyword appears in more than one satisfied block, only the first instance applies.
Criteria are User, Group, Host, LocalAddress, LocalPort and Address, with wildcards, negation and CIDR notation for addresses. Match All matches everything.
Only a subset of keywords may appear inside a block. The list includes AllowUsers, AllowGroups, AuthenticationMethods, AuthorizedKeysFile, ForceCommand, ChrootDirectory, the forwarding settings and PermitRootLogin, among others. Putting an unsupported keyword there is an error.
A realistic example
PermitRootLogin no
PasswordAuthentication no
Match Group sftp-only
ForceCommand internal-sftp
ChrootDirectory /srv/sftp/%u
AllowTcpForwarding no
Match Address 192.0.2.0/24
AuthenticationMethods publickey
The manual describes ForceCommand internal-sftp as forcing an in-process SFTP server that needs no support files when used with ChrootDirectory. The command is "most useful inside a Match block".
Check the effective result
Two flags from the sshd manual help:
sshd -tis test mode. It checks the validity of the configuration file and the sanity of the keys, which is useful before restarting.sshd -Tis extended test mode. It checks validity, prints the effective configuration to standard output and exits. You can apply Match rules by giving connection parameters with one or more-Coptions.
For example:
sshd -T -C user=alice,addr=192.0.2.15,host=bastion
Compare that output for a normal user, a service account and an admin. Look for permitrootlogin, authenticationmethods, allowtcpforwarding and forcecommand. The output is lowercase and lists every setting, so filter with grep.
Pitfalls
- Order. Because the first matching value wins, a broad block placed before a narrow one can hide the narrow one. Put specific blocks first.
- A
Matchat the end swallows later lines. Settings after a Match line belong to it until another Match. Keep global settings at the top, or useMatch Allto end a block. - Forwarding bans have a limit. The manual says disabling TCP forwarding does not improve security unless users are also denied shell access, because they can install their own forwarders. Pair it with a forced command or no shell.
- Test with a second session open. Reload, then open a new connection before closing the old one.
For a baseline of settings to check first, see six sshd settings to review.
Safeguard offers asset discovery and compliance evidence automation, and a free scan at gold.safeguard.sh/scan.
Quick check
What is the difference between sshd -t and sshd -T?
-t only checks the config file and keys. -T also prints the effective configuration, and with -C it applies Match rules for given connection parameters.
If two Match blocks both apply, which value wins?
For a keyword that appears in several satisfied blocks, only the first instance is applied.
Sources
Last reviewed: 19 October 2026.
