How can I run/tweak this command and while using ForceCommand to give this user their shell?

Client Command

(cat ./sudoPassword ./someCommandInput) | ssh user@ip "sudo -Sp '' someCommand"

Server sshd_config

ForceCommand /bin/bash

The behind the scenes restriction is that ForceCommand needs to be the mechanism that gives this user a shell, in addition to the command above a typical ssh user@ip needs to work too.

I have tried various configurations such as

ForceCommand /bin/bash -ic $SSH_ORIGINAL_COMMAND ls
ForceCommand /bin/bash -s < $SSH_ORIGINAL_COMMAND
ForceCommand /bin/bash -c $SSH_ORIGINAL_COMMAND

I've also tried messing around with the client command, giving ssh options like -tt but I can't seem to find the right configuration.

1 Answer 1


Use a wrapper script as the ForceCommand. Something like this script (say, saved at /usr/local/bin/myshell):

#! /bin/bash

if [[ -n $SSH_ORIGINAL_COMMAND ]] # command given, so run it
    exec /bin/bash -c "$SSH_ORIGINAL_COMMAND"
else # no command, so interactive login shell
    exec bash -il

In action:

% grep ForceCommand -B1 /etc/ssh/sshd_config
Match user muru
    ForceCommand /usr/local/bin/forceshell
% ssh muru@localhost
$ ls
Desktop   Documents   Downloads   Music   Pictures   Public   Templates   Videos
$ logout
Connection to localhost closed.
% ssh muru@localhost echo foo
% ssh muru@localhost echo '*'
Desktop   Documents   Downloads   Music   Pictures   Public   Templates   Videos

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.