Exclude specific group/users from ForceCommand in OpenSSH ssd_config

Question

I want to make ForceCommand internal-sftp and ChrootDirectory /jail the default for all users accessing a server via SSH. Only users in a certain group are allowed to escape this.

How can I exclude a certain group from ForceCommand internal-sftp in a Match block?

It's possible to reset ChrootDirectory by assigning a none value.

Matching the group and settingForceCommand none doesn't work (probably because there is no "none" program), ForceCommand bash works for shell access, but SFTP will no longer work.

Answer 1

this works for me with OpenSSH 5.1:

set a restricted default for everyone, but let the staff group have the (unrestricted) defaults.

Match Group *,!staff
        ChrootDirectory /home/ftp
        ForceCommand internal-sftp