Now this is weird and interesting...
If I change the "AllowGroups root users" line to "AllowGroups root users baduser", everything works as expected.
Note that user baduser is in both groups baduser and users. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org