Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

If a client does not execute a command (e.g. with -N) within some timeframe (1-2 seconds) after establishing the SSH connection, I'd like to terminate it from the server.

Unfortunately, ForceCommand and authorized_keys-prefixed commands do not execute either when run with -N, but clients could still conceivably request remote forwards (-R) tying up ports on your server.

I'd like to prevent this scenario but prefixing the keys with no-port-forwarding isn't an option because if they run a command I want to allow port forwarding. In this case my forced command executes and I can do validation to ensure that it is allowed.

Is my only option having some external process monitor sshd instances and check if they have any child processes (e.g. shell or executed command)?

share|improve this question
Did you manage to get this to wotk? – Paulo Arruda Nov 13 '14 at 6:56
@PauloArruda not to my recollection. I experimented with a monitor of sorts and then lost interest in the project. Sorry :( – bjeanes Mar 19 at 5:43
I solved it on my website using shell scripts. – Paulo Arruda Mar 24 at 21:21
@PauloArruda nice. Do you want to add an answer that describes what you're doing maybe with some critical code snippets. I'll accept it as the answer for the question if you do. – bjeanes Mar 26 at 21:27

1 Answer 1

If you say that -N works always, then there is no other option besides having external process monitor the childs of sshd. I have checked the man page for sshd_config and didn't find any option which would help you. Also it doesn't specify if -N should work with ForceCommand or not.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.