I've configured my sshd to run duo security via the FORCE_COMMAND option in the ssh config. That means that every time I login via ssh the duo security checks kick in which normally is a good thing. However, for the git login, I don't want these to kick in and I want to go straight through to the git-shell. This is bad for me because the git-shell correctly errors and doesn't allow me to send git commands. I get the error: fatal: unrecognized command '/usr/sbin/login_duo'. This is because the git-shell (by design) knows nothing of /usr/sbin/login_duo.

Is there any way to only run the FORCE_COMMAND for specific users? Any suggestions around how to get around this? Is the best way to create a separate sshd for just git?

1 Answer 1


You can configure sshd's force command support on a per-pubkey granularity rather than globally in sshd_config. See the example in the duo_unix documentation:


So you can wrap any pubkey of any user with login_duo by using "command=" in that user's ~/.ssh/authorized_keys.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .