Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How would one only allow certain commands to be run via SSH and block interactive sessions? does this as well as

I.e. this would work:

ssh <user@host> mkdir test
scp <file> <user@host>:test/

And this would not:

ssh <user@host>
share|improve this question

You can take advantage of the ability to restrict the key to a particular command using the command= directive in authorized_keys and the SSH_ORIGINAL_COMMAND variable that gets passed to the remote system.

In the authorized_keys file change the line containing the relevant key from

ssh-rsa AAAAB3NzaC1yc...


command="/path/to/myscript" ssh-rsa AAAAB3NzaC1yc...

Then create the myscript file like for example


if [  ! -n "$SSH_ORIGINAL_COMMAND" ]
    echo "No command supplied"
    exit 1


case "$1" in
      echo "invalid command"
      exit 1

    exec "$@"

so now if you run ssh user@remote.tld ls /etc you'll get a listing of the remote /etc directory. You'll probably want to use the case statements to test the supplied parameters to meet whatever your implementation requirements are.

share|improve this answer

Rather than writing your own shell from scratch, you might want to extend this:

It provides a shell you can set as a user (i.e. usermod or directly in /etc/passwd) which only supports SCP. You'll want to extend this to a few select binaries of your choice, of which none should be an interactive shell (e.g. /bin/bash, /bin/sh). More carefully, they shoudn't be able to upload one (e.g. a busybox binary) and set the executable bit so they can drop in their own shell.

share|improve this answer

Use a different shell for that user - you may have to write your own if you have specific requirements, but you would need to take a lot of care! Many shells offer restricted operation already but they may not be restricted enough for you.

Scp can make directories though - so what else do you need to allow the user to do through interactive ssh?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.