The list of users is controlled by the
- If the group doesn't exist, Remote Login is set to ‘All users’.
- If the group exists and has members, Remote Login is set to ‘Only these users’.
- If Remote Login is disabled, the group is renamed
com.apple.access_ssh-disabled which preserves members for when it is enabled.
You can see the group and manually edit it using Workgroup Manager without Terminal for testing.
To reset all settings and enable Remote Login, you can run the following. In my testing, it has not been necessary to disable remote login using the first command, but I include it for completeness.
sudo systemsetup -setremotelogin off
dseditgroup -o delete -q com.apple.access_ssh
dseditgroup -o delete -q com.apple.access_ssh-disabled
sudo systemsetup -setremotelogin on
To add a user to the group using the command line, you can use
dseditgroup, replacing ‘username’ with the username of the user to grant access to.
dseditgroup -o create -q username -t user com.apple.access_ssh