How to fix User user from hostname not allowed because a group is listed in DenyGroups in SSH

Connect to the server via console or as a user who can access it, then examine the SSH configuration:

sudo grep DenyGroups /etc/ssh/sshd_config

This will show which groups are currently denied. Also verify the user's group membership:

id username
groups username

Open the SSH configuration file with root privileges:

sudo vi /etc/ssh/sshd_config

Or use nano if you prefer:

sudo nano /etc/ssh/sshd_config

Option A: Remove or comment out DenyGroups (simplest)

Find the DenyGroups line and comment it out:

#DenyGroups groupname

Option B: Remove only the problematic group from DenyGroups

If you need DenyGroups but just need to exclude this specific group, edit the line:

DenyGroups othergroup1 othergroup2

Option C: Use Match block to override for specific users (most flexible)

Add this at the end of sshd_config to allow specific users despite DenyGroups:

Match User username1,username2
    DenyGroups none

This allows you to keep DenyGroups active for most users while exempting specific ones.

Before restarting sshd, check for syntax errors:

sudo sshd -t

If no output is shown, the configuration is valid. If there are errors, you'll see them printed.

Reload or restart sshd to apply the changes:

sudo systemctl restart sshd

Or on older systems:

sudo service ssh restart

Important: Keep your current SSH session open in case you need to troubleshoot. Test the connection from a new terminal.

From another terminal (or machine), attempt to SSH:

ssh username@hostname

If you still can't connect, check the sshd logs:

sudo tail -f /var/log/auth.log
# or on systems using journald:
sudo journalctl -u sshd -f

Look for the exact error message to determine if it's still a DenyGroups issue or something else.