mjhjmtu

I'm trying to apply the same sshd settings to multiple users.

According to the manual, it seems Match User acts like an AND:

Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file

How do I state "for any of these users...", so in this example bob, joe, and phil are allowed to use SSH as a proxy, but not allowed to log in:

Match User bob, User joe, User phil
 PasswordAuthentication yes
 AllowTCPForwarding yes
 ForceCommand /bin/echo 'We talked about this guys. No SSH for you!'

Not having done this myself, I can only go on what the manuals say:

From the sshd_config manual:

The match patterns may consist of single entries or
comma-separated lists and may use the wildcard and negation
operators described in the PATTERNS section of ssh_config(5).

This means that you ought to be able to say

Match User bob,joe,phil
 PasswordAuthentication yes
 AllowTCPForwarding yes
 ForceCommand /bin/echo 'We talked about this guys. No SSH for you!'

See also this answer on the Information Security forum: https://security.stackexchange.com/a/18038

Use the Match directive on a group instead of a user.
Then add the users to that group

Match Group users_with_no_ssh
 PasswordAuthentication yes
 AllowTCPForwarding yes
 ForceCommand /bin/echo 'We talked about this guys. No SSH for you!'

Basically your syntax is wrong, you have:

Match User bob, User joe, User phil

But it should be

Match User bob,joe,phil

I'm not sure ForceCommand would work well with SFTP. Also, maybe it's better to see 'DenyUsers' word in logs. Anyway, I use this (well, maybe it would be better to use Group):

sshd_config

# support, ansible & backup only from specific IP 
Match User ansible,backup,support Address *,!176.x.x.x 
 DenyUsers ansible,backup,support

Match User backup
 AllowTcpForwarding yes
 AllowAgentForwarding yes
 PermitListen 127.0.0.1:2223
 AcceptEnv RESTIC_REPOSITORY RESTIC_PASSWORD

Testing configuration

# sshd -T -C addr=176.x.x.x,user=backup | egrep '^((deny|allow)users|permitlisten|acceptenv)'
denyusers root
acceptenv RESTIC_REPOSITORY
acceptenv RESTIC_PASSWORD
permitlisten 127.0.0.1:2223

# sshd -T -C addr=8.8.4.4,user=backup | egrep '^((deny|allow)users|permitlisten|acceptenv)' 
denyusers ansible,backup,support
acceptenv RESTIC_REPOSITORY
acceptenv RESTIC_PASSWORD
permitlisten 127.0.0.1:2223

Real world test

Jan 29 16:50:12 mx1 sshd[71309]: Connection from 199.x.x.x port 21042 on 199.x.x.x port 2222 rdomain "0" 
Jan 29 16:50:13 mx1 sshd[71309]: User support from 199.x.x.x not allowed because listed in DenyUsers
Jan 29 16:50:13 mx1 sshd[71309]: Connection closed by invalid user support 199.x.x.x port 21042 [preauth]