It took me a long time to understand a line like 'DenyUsers user1,user2' wont affect user1 nor user2. It needs to read 'DenyUsers user1 user2' separated by spaces, as precised in the manpage As ',' is not allowed as a login character, it could be helpful at least to warn when parsing such a buggy config file. cheers, paul