Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several servers running Debian Lenny.

Just recently I discovered the PermitRootLogin=forced-commands-only directive for ssh, which allows me to run a scripted rsync as root with an ssl key, without enabling more generalized root ssh access.

However, last week this stopped working - it appears on all of my servers - and I can't figure out why.

Everything continues to work fine with PermitRootLogin=yes, but I would prefer to block root logins - especially via passwords.

The day it stopped working, we reconfigured some of the ports on one of our switches (which we later reverted), but I can't see that affecting this, since it still works with PermitRootLogin set to yes.

How can I diagnose why the forced-commands-only directive has apparently stopped working?

share|improve this question
How about looking in the logs on the server to see what it says when you try? Up the logging in sshd? – Bill Weiss Feb 9 '10 at 21:52
I tried running sshd with the -d (debug) switch, which gave alot of output, but was very cryptic to me. It appeared that it was accepting the certificate, and then dropping the connection immediately afterward with no further explanation. – Brent Feb 10 '10 at 17:27
up vote 8 down vote accepted

"PermitRootLogin forced-commands-only" requires that all connections, via SSH as root, need to use public key authentication and that a command be associated with that key (like 'validate-rsync').

If you want to login as root but only with keys use:

PermitRootLogin = without-password

To restrict rsync to a defined ssh-key you can specify in your authorized_keys:

from="<ip>",command="/usr/local/sbin/validate-rsync" ssh-dss AAAAZ5Hbl......

And save this wrapper to: /usr/local/sbin/validate-rsync


echo "Rejected" 
echo "Rejected" 
echo "Rejected" 
echo "Rejected" 
echo "Rejected" 
echo "Rejected" 
echo "Rejected" 
rsync\ --server*) 
echo "Rejected" 

There is a slightly more complicated script shipped with rsync to do the same,

share|improve this answer

If rsync can login as root, then anybody can: there's no difference for the server what's knocking at. I believe it was either experimental/hacky, or they just realized it's not more secure than 'yes'.

I'd suggest you disabling password auth for root (e.g. remove the password at all and use sudo when needed) and rely on key auth method.

share|improve this answer
Are you saying that openssh has disabled this option recently? If so, how can I confirm that? – Brent Feb 10 '10 at 17:25
I'm not sure, just guessing :) anyway, it's not more secure than just yes! – kolypto Feb 11 '10 at 13:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.