Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to allow ssh access to a specific account, but if I connect using a specific puclic key, I should be dropped to a full shell, otherwise to a restricted one.


I connect with ssh to using the public key ABCDEF (correctly set up in authorized_keys) and I get a /bin/zsh shell

If I connect to with a password or another public key, I get a /bin/rsh shell

My idea was to create a custom intermediate shell (IE: /bin/mysh), check the key used and execute the correct shell from there, but I don't know how to check which key was used (or if it's possible at all).

env doesn't seem to contain anything useful.

Any ideas on how to do this or other possible solutions?


share|improve this question
Maybe 2 different users with same UID, but different shells. – LatinSuD Oct 14 '10 at 10:05
question - if you have the "limited" key launch, say, /bin/ksh, what prevents them from starting /bin/bash after login? – warren Oct 14 '10 at 13:17
@warren, it would not be a "real" shell like ksh, so they wouldn't be able to do it. – Massimiliano Torromeo Oct 15 '10 at 11:19
@LatinSuD: it must be the same user – Massimiliano Torromeo Oct 15 '10 at 11:20
up vote 5 down vote accepted

Use the command option in the authorized_keys file on the key you want to use an alternate shell with. See the sshd(8) man page, AUTHORIZED_KEYS FILE FORMAT section, for details.

share|improve this answer
this is how, also can limit what can be done with the connection per key, meaning port forwarding etc – Jimsmithkka Oct 14 '10 at 11:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.