I have an interactive program. Actually, the program can be reachable over SSH. In the .profile file, the program is launched immediately and with the interactive interface it is not possible to launch any Linux command. However, it is trivial to get a command interpreter with SSH. So, I am wondering what the best practice to prevent the user from sending Linux command.
EDIT: If I used the following Python script:
#! /usr/bin/python3 # -*- coding: utf-8 -*- from pwn import * import time s = ssh(host='myip', user='myuser', password='mypassword') sh = s.run('ksh')
ksh will be ignored with Forcecommand?