How to fix User user from hostname not allowed because a group is listed in DenyGroups in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 136 views

This SSH error occurs when a user's group is explicitly denied in sshd_config via DenyGroups. Fix it by removing the group restriction, using a Match override, or removing the user from the denied group.

Quick fix

Fixes User user from hostname not allowed because a group is listed in DenyGroups

sudo grep DenyGroups /etc/ssh/sshd_config
  1. Check the current DenyGroups configuration
  2. Edit the sshd_config file
  3. Choose your fix strategy
  4. Validate the configuration syntax
ssh — error
sudo grep DenyGroups /etc/ssh/sshd_config
User user from hostname not allowed because a group is listed in DenyGroups

What this error means

OpenSSH applies access control through DenyGroups and AllowGroups directives in /etc/ssh/sshd_config. When a user attempts to connect, sshd checks if their primary group or any supplementary group matches a DenyGroups pattern. If a match is found, the connection is rejected immediately, even if other rules would allow access. The DenyGroups check takes precedence over AllowGroups, making it a hard block.

Typical symptoms

  • SSH login fails with "Permission denied, please try again" when attempting to connect
  • sshd logs show "User <username> from <hostname> not allowed because a group is listed in DenyGroups"
  • The error occurs consistently for all users in the denied group, regardless of their individual user permissions
  • Other SSH methods (key-based, password) fail with the same error if the user is in a denied group

Common causes

  1. DenyGroups directive is configured in /etc/ssh/sshd_config with the user's primary group listed
  2. User belongs to a supplementary group that matches a DenyGroups pattern
  3. DenyGroups rule was added to restrict access but now blocks legitimate users
  4. Group names in DenyGroups contain patterns or wildcards that unintentionally match the user's group

How to fix "User user from hostname not allowed because a group is listed in DenyGroups"

1Check the current DenyGroups configuration

Connect to the server via console or as a user who can access it, then examine the SSH configuration:

bash
sudo grep DenyGroups /etc/ssh/sshd_config

This will show which groups are currently denied. Also verify the user's group membership:

bash
id username
groups username
2Edit the sshd_config file

Open the SSH configuration file with root privileges:

bash
sudo vi /etc/ssh/sshd_config

Or use nano if you prefer:

bash
sudo nano /etc/ssh/sshd_config
3Choose your fix strategy

Option A: Remove or comment out DenyGroups (simplest)

Find the DenyGroups line and comment it out:

bash
#DenyGroups groupname

Option B: Remove only the problematic group from DenyGroups

If you need DenyGroups but just need to exclude this specific group, edit the line:

bash
DenyGroups othergroup1 othergroup2

Option C: Use Match block to override for specific users (most flexible)

Add this at the end of sshd_config to allow specific users despite DenyGroups:

bash
Match User username1,username2
    DenyGroups none

This allows you to keep DenyGroups active for most users while exempting specific ones.

4Validate the configuration syntax

Before restarting sshd, check for syntax errors:

bash
sudo sshd -t

If no output is shown, the configuration is valid. If there are errors, you'll see them printed.

5Restart the SSH service

Reload or restart sshd to apply the changes:

bash
sudo systemctl restart sshd

Or on older systems:

bash
sudo service ssh restart

Important: Keep your current SSH session open in case you need to troubleshoot. Test the connection from a new terminal.

6Test SSH access and verify the fix

From another terminal (or machine), attempt to SSH:

bash
ssh username@hostname

If you still can't connect, check the sshd logs:

bash
sudo tail -f /var/log/auth.log
# or on systems using journald:
sudo journalctl -u sshd -f

Look for the exact error message to determine if it's still a DenyGroups issue or something else.

Advanced notes

Deny directives take strict precedence in OpenSSH. The processing order is: DenyUsers → AllowUsers → DenyGroups → AllowGroups. This means if a user is in DenyGroups, no other allow rule can override it unless you use a Match block. If using Match blocks, place them after the global directives. On systems using domain users or LDAP, group membership may be determined by supplementary groups, so verify with id -G username. On SELinux systems, also check SELinux policies as they may add additional access controls independent of sshd_config.

Frequently asked questions

What does "User user from hostname not allowed because a group is listed in DenyG" mean?
OpenSSH applies access control through DenyGroups and AllowGroups directives in /etc/ssh/sshd_config. When a user attempts to connect, sshd checks if their primary group or any supplementary group matches a DenyGroups pattern. If a match is found, the connection is rejected immediately, even if other rules would allow access.
How do I fix "User user from hostname not allowed because a group is listed in DenyG"?
This SSH error occurs when a user's group is explicitly denied in sshd_config via DenyGroups. Fix it by removing the group restriction, using a Match override, or removing the user from the denied group.
What causes "User user from hostname not allowed because a group is listed in DenyG"?
DenyGroups directive is configured in /etc/ssh/sshd_config with the user's primary group listed User belongs to a supplementary group that matches a DenyGroups pattern DenyGroups rule was added to restrict access but now blocks legitimate users
Is the "User user from hostname not allowed because a group is listed in DenyG" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading