SSH forcecommand, but don't limit root

Question

I was using ssh's "forcecommand" option to pass a shell script that would help lock out users from ssh. I was wondering if their was a way to do this without forcing root to have to execute the shell script as well.

Thanks!

Answer 1

sshd allows us to override default settings for selected user (User, Group, Host or Address).

We can accompilsh this using Match block. In Match block we must set condition and settings that we want to change.

I don't know if it is possible to unset option in sshd_config (for example by using option without args), but if it isn't possible you could create group of users that you want to restrict and apply ForceCommand only to that group.

Config with unset option:

Match User root
       ForceCommand #some way to unset option?

Config with restricted group:

Match Group restrictedsshd
       ForceCommand /some/script.sh

More info about Match option you could find in man sshd_config.

Answer 2

From man sshd (LOGIN PROCESS):
3. Checks /etc/nologin; if it exists, prints contents and quits (unless root).