From man 8 sshd
with regards to the Authorized Keys File Format and the command="command"
option:
Note that this command may be superseded by either an sshd_config(5) ForceCommand directive or a command embedded in a certificate.
Using ssh-keygen -O force-command="command"
allows a command to be embedded in a certificate. But how does one verify that a command has not been embedded in a certificate? Along these same lines of preventing unexpected commands from being executed, does ForceCommand
always override a command embedded in a certificate?
Can a malicious user bypass a ssh authorized_keys forced command? asks a more general question about security but currently the answers there do not mention commands embedded in certificates.
OpenSSH_5.9p1 Debian-5ubuntu1.1, OpenSSL 1.0.1 14 Mar 2012
andOpenSSH_6.2p2 Debian-6~bpo70+1, OpenSSL 1.0.1e 11 Feb 2013
ssh-keygen -L
is for certificates but not for RSA keys.ssh-keygen -lf
shows a fingerprint but not embedded commands.openssl rsa -in file -text -noout
shows modulus and exponents but not embedded commands.