Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to use a passwordless key to perform e.g. unison synchronization while being able to SSH into the server only with a password-protected key. The usual way of using scponly is changig the login-shell of my server account, but that is too global. Can an entry in authorized_keys achieve this instead?

share|improve this question
up vote 5 down vote accepted

You can use command keyword in authorized_keys to restrict execution to one single command for particular key, like this:

command="/usr/local/bin/mysync" ...sync public key... 

Update: If you specify a simple script as the command you may verify the command user originally supplied:


/path/to/unison *) 
echo "Rejected" 
share|improve this answer
Doesn't that simply execute that command? I'd like sshd to only allow a ssh server -c unison ... while any other attempt to connect with that key should not execute anything but simple refuse connecting – Tobias Kienzler Nov 14 '12 at 8:32
It is possible, I updated the answer. But what the reason for such behavior? If you have the key you have permission to sync. So you rather connect and do the job or don't connect at all... – Andrey Voitenkov Nov 14 '12 at 9:13
Perfect, I used case "$(basename $SSH_ORIGINAL_COMMAND)" in \n unison *) though. The reason is I want to have a private key that doesn't require a password so unison can run unattended (e.g. as a cronjob), while that key should not be capable of allowing a SSH access. Of course unison could be abused to replace authorized_keys... – Tobias Kienzler Nov 14 '12 at 9:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.