How to fix User user from hostname not allowed because none of user's groups are listed in AllowGroups in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 221 views

This SSH error occurs when a user's group membership does not match the AllowGroups directive in sshd_config. The fix involves adding the user's group to the allowed groups list or verifying group membership.

Quick fix

Fixes User user from hostname not allowed because none of user's groups are listed in AllowGroups

sudo grep AllowGroups /etc/ssh/sshd_config
  1. Check the current AllowGroups configuration
  2. Verify the user's group membership
  3. Add the user to an allowed group
  4. Create the allowed group if it doesn't exist
ssh — error
sudo grep AllowGroups /etc/ssh/sshd_config
User user from hostname not allowed because none of user's groups are listed in AllowGroups

What this error means

The SSH daemon (sshd) restricts login access based on group membership through the AllowGroups directive. When AllowGroups is configured, only users whose primary group or any supplementary group matches one of the specified patterns are permitted to authenticate. This error indicates the connecting user's groups do not match any entry in the AllowGroups configuration, preventing authentication before credential verification.

Typical symptoms

  • SSH login fails with "not allowed because none of user's groups are listed in AllowGroups" message
  • User can successfully authenticate with key/password but is denied after credential verification
  • Connection closes immediately after password entry without showing interactive prompt
  • Works for some users but not others in the same group
  • Error appears in sshd logs but user credentials are valid

Common causes

  1. User's primary group or supplementary groups do not match any pattern in AllowGroups
  2. AllowGroups directive is configured but the user has not been added to an allowed group
  3. User was removed from or never added to the appropriate group
  4. Group name in AllowGroups contains spaces and is not properly quoted (especially with LDAP groups)
  5. Group membership change occurred but user has not logged out and back in to refresh group cache

How to fix "User user from hostname not allowed because none of user's groups are listed in AllowGroups"

1Check the current AllowGroups configuration

View the SSH daemon configuration to see which groups are allowed:

bash
sudo grep AllowGroups /etc/ssh/sshd_config

If the line is commented out (starts with #) or missing, all groups are allowed. If present, note the group names listed.

2Verify the user's group membership

Check what groups the user belongs to:

bash
id username

Look for the user's primary group (first group) and supplementary groups (listed after "groups="). Compare these against the AllowGroups configuration from step 1.

3Add the user to an allowed group

If the user's groups don't match AllowGroups, add them to an appropriate allowed group:

bash
sudo usermod -aG allowed_group_name username

Replace allowed_group_name with one of the groups specified in AllowGroups (e.g., ssh-users, sysadmin, developers).

4Create the allowed group if it doesn't exist

If the group specified in AllowGroups doesn't exist, create it:

bash
sudo groupadd ssh-users
sudo usermod -aG ssh-users username

Then verify the group was created:

bash
getent group ssh-users
5Refresh group membership (if using local groups)

For local groups, the user may need to log out completely and log back in to refresh their group membership cache. If they have active sessions, group changes may not be reflected immediately. Kill existing sessions:

bash
sudo pkill -u username

Then have the user attempt to SSH again.

6Handle LDAP group names with spaces

If using LDAP and group names contain spaces, ensure the sshd_config directive uses quotes:

bash
AllowGroups "Domain Users" "SSH Access"

Without quotes, spaces in group names cause parsing issues. Edit /etc/ssh/sshd_config and restart sshd:

bash
sudo systemctl restart sshd

Advanced notes

The allow/deny directives are processed in order: DenyUsers → AllowUsers → DenyGroups → AllowGroups. A user passes all checks to gain access. On Linux systems with NSS (Name Service Switch), group membership may be cached by the system; the getent group command shows the authoritative group membership from configured sources (local /etc/group, LDAP, NIS, etc.). In enterprise environments using LDAP or Active Directory, group membership changes may take time to propagate to all machines due to caching; if a user was just added to a group, wait a few minutes and retry. For Windows OpenSSH, supplementary group support varies by version and may require local group workarounds.

Frequently asked questions

What does "User user from hostname not allowed because none of user's groups are" mean?
The SSH daemon (sshd) restricts login access based on group membership through the AllowGroups directive. When AllowGroups is configured, only users whose primary group or any supplementary group matches one of the specified patterns are permitted to authenticate. This error indicates the connecting user's groups do not match any entry in the AllowGroups configuration, preventing authentication before credential verification.
How do I fix "User user from hostname not allowed because none of user's groups are"?
This SSH error occurs when a user's group membership does not match the AllowGroups directive in sshd_config. The fix involves adding the user's group to the allowed groups list or verifying group membership.
What causes "User user from hostname not allowed because none of user's groups are"?
User's primary group or supplementary groups do not match any pattern in AllowGroups AllowGroups directive is configured but the user has not been added to an allowed group User was removed from or never added to the appropriate group
Is the "User user from hostname not allowed because none of user's groups are" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading