I am trying to restrict an ssh-user from executing unwanted commands through ssh from a remote host. For that I am using the forced command in the authorized_keys file that will allow the ssh-user to only execute a particular command.

If I did not set this, I am able to login via ssh and sftp.

How can I differentiate whether the remote connection is issued via ssh or sftp in a shell script?

The command that I am expecting is as follows and these both should work:-

ssh ssh-user@hostname test_scripts.sh

sftp ssh-user@hostname

I used the variable $TERM to differentiate between ssh and sftp. If it is sftp then the $TERM will return 'dumb'. But when we are passing a command through ssh then also the $TERM is returning dumb. Any idea how to differentiate?

Adding More details to the question :-

if [ $TERM = 'dumb' ]; then

$SSH_ORIGINAL_COMMAND #If sftp, execute this


echo "This is ssh" #If ssh, execute this


The above script is the invoked via forced command. When I am connecting remotely through ssh then I am getting the message as expected as "This is ssh"

ssh ssh-user@hostname This is ssh

And when I am trying to connect through sftp then as expected the if condition got true and I am getting the sftp prompt.

sftp ssh-user@hostname sftp>

But when I am passing a command along with the ssh command then the $TERM is set to dumb. So the if condition got true.

ssh ssh-user@hostname ls

I need to distinguish between the latter two methods in the above script. Could anyone help me on this?


Have a look at Restricted Bash - usually at /bin/rbash. I used this recently to achieve something similar to what you're trying to do (after farting about with chroot jails and not really getting anywhere).

For the users that I wanted to restrict, I set their terminal to /bin/rbash and their PATH to ${HOME}/bin. I then created a symlink to whatever commands I wanted them to be allowed to run in their ${HOME}/bin directory. I don't think it's 100% foolproof but it did the job with my users.

I haven't tested it for commands that are sent as part of the SSH command-line but I don't see why it wouldn't work so long as the user's shell is set to rbash.

  • This is a normal user in the server. He should be allowed the sftp prompt. But the user should not be allowed a prompt while connected via ssh. The user should be allowed to execute commands passed along with ssh as follows e.g :- ssh user@hostname <cmd> – user156372 Jan 28 '13 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.