Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was using ssh's "forcecommand" option to pass a shell script that would help lock out users from ssh. I was wondering if their was a way to do this without forcing root to have to execute the shell script as well.


share|improve this question
you should accept an answer, if it helped. – 0xC0000022L Jul 11 '11 at 2:43

sshd allows us to override default settings for selected user (User, Group, Host or Address).

We can accompilsh this using Match block. In Match block we must set condition and settings that we want to change.

I don't know if it is possible to unset option in sshd_config (for example by using option without args), but if it isn't possible you could create group of users that you want to restrict and apply ForceCommand only to that group.

Config with unset option:

Match User root
       ForceCommand #some way to unset option?

Config with restricted group:

Match Group restrictedsshd
       ForceCommand /some/

More info about Match option you could find in man sshd_config.

share|improve this answer

From man sshd (LOGIN PROCESS):
3. Checks /etc/nologin; if it exists, prints contents and quits (unless root).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.