Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a user that I'd like to only be able to use subversion. We like to use svn+ssh:// URLs sometimes (for public keys and whatnot), so I need them to be able to connect over ssh and run only the svnserve command.

When using a svn+ssh URL, svn ssh'es in and passes the arguments "-c svnserve -t". I wrote a custom shell as follows to filter the commands that can be run. This works, but it's not passing the input to svnserve, so when I try to "svn up" I get "svn: Connection closed unexpectedly".

if [ "$1" == "-c" ] && [ "$2" == "svnserve" ] && [ "$3" == "-t" ] && [ "$4" == ""] ; then
        exec svnserve -t
        echo "Access denied. User may only run svnserve."
share|improve this question
You should be aware that your test allows calls such as -c svnserve -t "" somethingmore. Instead of checking for $4 to be null, you should check for the arg count. if [ "$1" == "-c" ] && [ "$2" == "svnserve" ] && [ "$3" == "-t" ] && [ $# = 3 ] – Dennis Williamson Mar 17 '10 at 22:24
up vote 4 down vote accepted

I am pretty sure you could put something like this at the end of your sshd_config.

Match User svnuser
  ForceCommand svnserve -t
share|improve this answer
That works, thanks! – sbleon Mar 19 '10 at 13:49

In the file authorized_keys add the line command="svnserve" and whatnot at the beginning of his key. In this way when he connect with ssh it will run that command then exit, e.g.

command="svnserve" ssh-rsa AAA...LONG AND TEDIOUS KEY...== user@localhost

check man sshd and the subversion documentation for details

share|improve this answer
We're not necessarily using public key auth, but thanks for the suggestion. – sbleon Mar 19 '10 at 13:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.