diff --git a/ChangeLog b/ChangeLog
index f595caff9..a3ec14bef 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -24,6 +24,9 @@
      [auth.c match.c match.h]
      delay hostname lookup until we see a ``@'' in DenyUsers and AllowUsers
      for sshd -u0; ok markus@
+   - stevesk@cvs.openbsd.org 2002/02/28 20:36:42
+     [sshd.8]
+     DenyUsers allows user@host pattern also
 
 20020226
  - (tim) Bug 12 [configure.ac] add sys/bitypes.h to int64_t tests
@@ -7755,4 +7758,4 @@
  - Wrote replacements for strlcpy and mkdtemp
  - Released 1.0pre1
 
-$Id: ChangeLog,v 1.1897 2002/03/05 01:35:23 mouring Exp $
+$Id: ChangeLog,v 1.1898 2002/03/05 01:37:12 mouring Exp $
diff --git a/sshd.8 b/sshd.8
index cf7410990..ff816aee7 100644
--- a/sshd.8
+++ b/sshd.8
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd.8,v 1.168 2002/02/10 01:07:05 deraadt Exp $
+.\" $OpenBSD: sshd.8,v 1.169 2002/02/28 20:36:42 stevesk Exp $
 .Dd September 25, 1999
 .Dt SSHD 8
 .Os
@@ -457,6 +457,9 @@ and
 can be used as wildcards in the patterns.
 Only user names are valid; a numerical user ID is not recognized.
 By default, login is allowed for all users.
+If the pattern takes the form USER@HOST then USER and HOST
+are separately checked, restricting logins to particular
+users from particular hosts.
 .It Cm GatewayPorts
 Specifies whether remote hosts are allowed to connect to ports
 forwarded for the client.