Does anyone happen to know if there is way to prevent specific commands to be executed via SSH?

For example, lets say that I do not want someone to be able to run firefox or matlab via SSH, but if they are locally at the machine then it should be fine.

I am mainly asking because I have a piece of software with a license agreement with a no remote use policy.

  • 2
    You could probably put something together by setting the software group-executable-only, then grant group membership with pam_group (linux.die.net/man/8/pam_group) when users are logged in locally. Is that the sort of thing you want? Commented Sep 20, 2017 at 17:20
  • Not sure if that will 100% work, maybe what i am interested in is limiting some command from /bin to be executable locally... Commented Sep 20, 2017 at 17:49
  • 1
    @FoxWilson We don't know that this is Linux.
    – Kusalananda
    Commented Sep 20, 2017 at 19:37
  • Also pam_group might not work if users log into gnome desktop.
    – sebasth
    Commented Sep 20, 2017 at 20:03

2 Answers 2


Variation on Hunter.S.Thompson's answer:

In a shell startup file:

if [ -n "$SSH_CLIENT" ]; then
   alias matlab='echo "restricted to local users only, sorry"'
   alias firefox='echo "restricted to local users only, sorry"'

This does not prevent anyone to bypass these aliases, so instead one could create a shell script for each restricted software.

For example: /usr/local/bin/matlab:


if [ -n "$SSH_CLIENT" ]; then
   echo 'restricted to local users only, sorry' >&2
   exit 1

exec /real/path/to/matlab

This does not prevent the user from unsetting their SSH_CLIENT environment variable, or executing the real matlab program directly.


Add this in your ~/.bashrc, this will make sure only a local tty will be able to run this sofware.

When the user logins in via ssh, server adds an alias to the command which will just echo "Restricted. Can only be run locally."

whichtty=$( ps hotty $$ | grep pts )

if [ $? -eq 0 ]; then
    alias <software_name>='echo Restricted. Can only be run locally.'

A SSH session will be on a pseudo-terminal slave (pts) as shown in the TTY column, but not all pts connections are SSH sessions. For example, programs that create a pseudo-terminal device such as xterm or screen will show as pts. So the downside to this script is that you cannot run this software from your local xterm or screen.

You will have to run the software from the launcher.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .