Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there an option similar to no-user-rc that I can use in sshd_config?

I want to prevent from executing the ~/.ssh/rc file for everybody (whether logging in using a password or key).

Using Openssh 5.3p1.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If restricting everyone to using authorized keys only is not an option, you can use the ForceCommand directive in sshd_config to achieve what you want (Openssh 4.9 or later). See OpenSSH Security:

OpenSSH 4.9 and newer do not execute ~/.ssh/rc for sessions whose command has been overridden with a sshd_config(5) ForceCommand directive. This was a documented, but unsafe behaviour (described in OpenSSH 4.9 release notes).

The patch notes for OpenSSH 4.9 state the following regarding ForceCommand:

Disable execution of ~/.ssh/rc for sessions where a command has been forced by the sshd_config ForceCommand directive. Users who had write access to this file could use it to execute abritrary commands. This behaviour was documented, but was an unsafe default and an extra hassle for administrators.

One suggestion would be to use the solution proposed in this thread "ForceCommand and ~/.ssh/rc".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.