I have an interactive program. Actually, the program can be reachable over SSH. In the .profile file, the program is launched immediately and with the interactive interface it is not possible to launch any Linux command. However, it is trivial to get a command interpreter with SSH. So, I am wondering what the best practice to prevent the user from sending Linux command.

EDIT: If I used the following Python script:

#! /usr/bin/python3
# -*- coding: utf-8 -*-

from pwn import *
import time

s =  ssh(host='myip', user='myuser', password='mypassword')

sh = s.run('ksh')

The command ksh will be ignored with Forcecommand?

1 Answer 1


You can do this using the ForceCommand option in sshd_config:


Forces the execution of the command specified by ForceCommand, ignoring any command supplied by the client and ~/.ssh/rc if present. The command is invoked by using the user's login shell with the -c option. This applies to shell, command, or subsystem execution. It is most useful inside a Match block.

You can specify a Match block that is specific to the user or group you're trying to control.

  • If i use a script to connect to the SSH and send a command through tue program, the command will be ignored too? I will update my question.
    – salt
    Commented Mar 12, 2021 at 18:17
  • Yes, that would be an example of the "command supplied by the client"
    – gowenfawr
    Commented Mar 12, 2021 at 18:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .