diff -urp openssh-5.9p1/auth.c openssh-5.9p1a/auth.c
--- openssh-5.9p1/auth.c	2011-05-29 21:40:42.000000000 +1000
+++ openssh-5.9p1a/auth.c	2012-02-14 13:16:38.000000000 +1100
@@ -177,11 +177,16 @@ allowed_user(struct passwd * pw)
 		xfree(shell);
 	}
 
+
+
 	if (options.num_deny_users > 0 || options.num_allow_users > 0 ||
 	    options.num_deny_groups > 0 || options.num_allow_groups > 0) {
 		hostname = get_canonical_hostname(options.use_dns);
 		ipaddr = get_remote_ipaddr();
 	}
+# if	defined( ALTERNATE_AUTH_POLICY)
+/*--*/	if (!options.alternate_allow_policy) {
+# endif
 
 	/* Return false if user is listed in DenyUsers */
 	if (options.num_deny_users > 0) {
@@ -240,6 +245,83 @@ allowed_user(struct passwd * pw)
 			}
 		ga_free();
 	}
+# if	defined( ALTERNATE_AUTH_POLICY)
+/*--*/ } else {
+		int	deny_users_empty	= (options.num_deny_users==0);
+		int	deny_user		= 0;
+		int	allow_users_empty	= (options.num_allow_users==0);
+		int	allow_user		= 0;
+		int	deny_groups_empty	= (options.num_deny_groups==0);
+		int	deny_group		= 0;
+		int	allow_groups_empty	= (options.num_allow_groups==0);
+		int	allow_group		= 0;
+		int	policy			= 0;
+		int	i	= 0;
+		int	j	= options.num_deny_users;
+		while (i!=j) {
+			deny_user	= match_user(pw->pw_name, hostname,
+				ipaddr, options.deny_users[i]);
+			if (deny_user) {
+				logit("User %.100s from %.100s not allowed "
+				    "because listed in DenyUsers",
+				    pw->pw_name, hostname);
+					j	= i;
+			}
+			else	++i;
+		}
+		i	= 0;
+		j	=	options.num_allow_users;
+		while (i!=j) {
+			allow_user	= match_user(pw->pw_name, hostname,
+				ipaddr, options.allow_users[i]);
+			if (allow_user) {
+				j	= i;
+			}
+			else	++i;
+		}
+		if (!deny_groups_empty || !allow_groups_empty) {
+			if (ga_init(pw->pw_name, pw->pw_gid)==0) {
+				logit("User %.100s from %.100s not allowed because "
+                            "not in any group", pw->pw_name, hostname);
+				return	0;
+			}
+		}
+		i	= 0;
+		j	= options.num_deny_groups;
+		while (i!=j) {
+			deny_group	= ga_match(options.deny_groups,
+					    options.num_deny_groups);	
+			if (deny_group) {
+				j	= i;
+			}
+			else	++i;
+		}
+		i	= 0;
+		j	= options.num_allow_groups;
+		while (i!=j) {
+			allow_group	= ga_match(options.allow_groups,
+					    options.num_allow_groups);
+			if (allow_group) {
+				j	= i;
+			}
+			else	++i;
+		}
+		if (!deny_groups_empty || !allow_groups_empty) {
+			ga_free();
+		}
+		policy	= options.allow_by_default;
+		if ((!deny_users_empty && deny_user) || 
+			(!deny_groups_empty && deny_group)) {
+				policy	= 0;
+		}
+		else if ((!allow_users_empty && allow_user) ||
+			(!allow_groups_empty&&allow_group)) {
+				policy	= 1;
+		}
+		return	policy;
+	}
+# endif
+
 
 #ifdef CUSTOM_SYS_AUTH_ALLOWED_USER
 	if (!sys_auth_allowed_user(pw, &loginmsg))
diff -urp openssh-5.9p1/servconf.c openssh-5.9p1a/servconf.c
--- openssh-5.9p1/servconf.c	2011-06-23 08:30:03.000000000 +1000
+++ openssh-5.9p1a/servconf.c	2012-02-14 13:16:38.000000000 +1100
@@ -111,6 +111,10 @@ initialize_server_options(ServerOptions 
 	options->num_deny_users = 0;
 	options->num_allow_groups = 0;
 	options->num_deny_groups = 0;
+# if    defined (ALTERNATE_AUTH_POLICY)
+	options->alternate_allow_policy	= -1;
+	options->allow_by_default	= -1;
+# endif
 	options->ciphers = NULL;
 	options->macs = NULL;
 	options->kex_algorithms = NULL;
@@ -146,6 +150,13 @@ fill_default_server_options(ServerOption
 	/* Portable-specific options */
 	if (options->use_pam == -1)
 		options->use_pam = 0;
+# if    defined (ALTERNATE_AUTH_POLICY)
+	if (options->alternate_allow_policy == -1)
+		options->alternate_allow_policy	= 0;
+	if (options->alternate_allow_policy == 1 &&
+		options->allow_by_default == -1)
+			options->allow_by_default	= 0;
+# endif
 
 	/* Standard Options */
 	if (options->protocol == SSH_PROTO_UNKNOWN)
@@ -312,6 +323,9 @@ typedef enum {
 	sStrictModes, sEmptyPasswd, sTCPKeepAlive,
 	sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
 	sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
+# if    defined( ALTERNATE_AUTH_POLICY)
+	sAlternateAllowPolicy, sAllowByDefault,
+# endif
 	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
 	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
 	sMaxStartups, sMaxAuthTries, sMaxSessions,
@@ -419,6 +433,10 @@ static struct {
 	{ "denyusers", sDenyUsers, SSHCFG_GLOBAL },
 	{ "allowgroups", sAllowGroups, SSHCFG_GLOBAL },
 	{ "denygroups", sDenyGroups, SSHCFG_GLOBAL },
+# if	defined (ALTERNATE_AUTH_POLICY)
+	{ "alternateallowpolicy", sAlternateAllowPolicy, SSHCFG_GLOBAL },
+	{ "allowbydefault", sAllowByDefault, SSHCFG_GLOBAL },
+# endif
 	{ "ciphers", sCiphers, SSHCFG_GLOBAL },
 	{ "macs", sMacs, SSHCFG_GLOBAL },
 	{ "protocol", sProtocol, SSHCFG_GLOBAL },
@@ -753,6 +771,14 @@ process_server_config_line(ServerOptions
 	}
 
 	switch (opcode) {
+# if    defined (ALTERNATE_AUTH_POLICY)
+	case sAlternateAllowPolicy:
+		intptr	= &options->alternate_allow_policy;
+		goto parse_flag;
+	case sAllowByDefault:
+		intptr	= &options->allow_by_default;
+		goto parse_flag;
+# endif
 	/* Portable-specific options */
 	case sUsePAM:
 		intptr = &options->use_pam;
@@ -1774,6 +1800,11 @@ dump_config(ServerOptions *o)
 	dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
 	dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
 	dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
+# if	defined (ALTERNATE_AUTH_POLICY)
+	dump_cfg_int(sAlternateAllowPolicy, o->alternate_allow_policy);
+	dump_cfg_int(sAllowByDefault, o->allow_by_default);
+# endif
+	
 	dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
 
 	/* other arguments */
diff -urp openssh-5.9p1/servconf.h openssh-5.9p1a/servconf.h
--- openssh-5.9p1/servconf.h	2011-06-23 08:30:03.000000000 +1000
+++ openssh-5.9p1a/servconf.h	2012-02-14 13:16:38.000000000 +1100
@@ -125,6 +125,10 @@ typedef struct {
 	char   *allow_groups[MAX_ALLOW_GROUPS];
 	u_int num_deny_groups;
 	char   *deny_groups[MAX_DENY_GROUPS];
+# if    defined (ALTERNATE_AUTH_POLICY)
+	int	alternate_allow_policy;
+	int	allow_by_default;
+# endif
 
 	u_int num_subsystems;
 	char   *subsystem_name[MAX_SUBSYSTEMS];
