From man 8 sshd with regards to the Authorized Keys File Format and the command="command" option:

Note that this command may be superseded by either an sshd_config(5) ForceCommand directive or a command embedded in a certificate.

Using ssh-keygen -O force-command="command" allows a command to be embedded in a certificate. But how does one verify that a command has not been embedded in a certificate? Along these same lines of preventing unexpected commands from being executed, does ForceCommand always override a command embedded in a certificate?

Can a malicious user bypass a ssh authorized_keys forced command? asks a more general question about security but currently the answers there do not mention commands embedded in certificates.

  • Which version of ssh/sshd etc is this ? – user9517 Oct 5 '13 at 19:27
  • OpenSSH_5.9p1 Debian-5ubuntu1.1, OpenSSL 1.0.1 14 Mar 2012 and OpenSSH_6.2p2 Debian-6~bpo70+1, OpenSSL 1.0.1e 11 Feb 2013 – Monica For CEO Oct 5 '13 at 19:34
  • And if I understand properly, ssh-keygen -L is for certificates but not for RSA keys. – Monica For CEO Oct 5 '13 at 19:38
  • ssh-keygen -lf shows a fingerprint but not embedded commands. – Monica For CEO Oct 5 '13 at 19:39
  • openssl rsa -in file -text -noout shows modulus and exponents but not embedded commands. – Monica For CEO Oct 5 '13 at 19:42

The ssh-keygen man page says

-O option

        Specify a certificate option when signing a key.

The -O force-command=command option relates to certificates not keys.

You will need to generate a certificate by signing a key, then you should be able to decode the certificate and see the embedded command.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.