Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From man 8 sshd with regards to the Authorized Keys File Format and the command="command" option:

Note that this command may be superseded by either an sshd_config(5) ForceCommand directive or a command embedded in a certificate.

Using ssh-keygen -O force-command="command" allows a command to be embedded in a certificate. But how does one verify that a command has not been embedded in a certificate? Along these same lines of preventing unexpected commands from being executed, does ForceCommand always override a command embedded in a certificate?

Can a malicious user bypass a ssh authorized_keys forced command? asks a more general question about security but currently the answers there do not mention commands embedded in certificates.

share|improve this question
    
Which version of ssh/sshd etc is this ? –  Iain Oct 5 '13 at 19:27
    
OpenSSH_5.9p1 Debian-5ubuntu1.1, OpenSSL 1.0.1 14 Mar 2012 and OpenSSH_6.2p2 Debian-6~bpo70+1, OpenSSL 1.0.1e 11 Feb 2013 –  Daniel Kauffman Oct 5 '13 at 19:34
    
And if I understand properly, ssh-keygen -L is for certificates but not for RSA keys. –  Daniel Kauffman Oct 5 '13 at 19:38
    
ssh-keygen -lf shows a fingerprint but not embedded commands. –  Daniel Kauffman Oct 5 '13 at 19:39
    
openssl rsa -in file -text -noout shows modulus and exponents but not embedded commands. –  Daniel Kauffman Oct 5 '13 at 19:42

1 Answer 1

The ssh-keygen man page says

-O option

        Specify a certificate option when signing a key.

The -O force-command=command option relates to certificates not keys.

You will need to generate a certificate by signing a key, then you should be able to decode the certificate and see the embedded command.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.