How to fix User user from hostname not allowed because none of user's groups are listed in AllowGroups in SSH

View the SSH daemon configuration to see which groups are allowed:

sudo grep AllowGroups /etc/ssh/sshd_config

If the line is commented out (starts with #) or missing, all groups are allowed. If present, note the group names listed.

Check what groups the user belongs to:

id username

Look for the user's primary group (first group) and supplementary groups (listed after "groups="). Compare these against the AllowGroups configuration from step 1.

If the user's groups don't match AllowGroups, add them to an appropriate allowed group:

sudo usermod -aG allowed_group_name username

Replace allowed_group_name with one of the groups specified in AllowGroups (e.g., ssh-users, sysadmin, developers).

If the group specified in AllowGroups doesn't exist, create it:

sudo groupadd ssh-users
sudo usermod -aG ssh-users username

Then verify the group was created:

getent group ssh-users

For local groups, the user may need to log out completely and log back in to refresh their group membership cache. If they have active sessions, group changes may not be reflected immediately. Kill existing sessions:

sudo pkill -u username

Then have the user attempt to SSH again.

If using LDAP and group names contain spaces, ensure the sshd_config directive uses quotes:

AllowGroups "Domain Users" "SSH Access"

Without quotes, spaces in group names cause parsing issues. Edit /etc/ssh/sshd_config and restart sshd:

sudo systemctl restart sshd