During authentication of SSH user, is there a way we can tell between SSH session vs SSH inline command? I have tried checking tty but they are coming up the same in both cases for me. In my scenario, I need a way to block user (during authentication) from doing "ssh user@hostname 'some cmd'" but allow the user to log in via SSH otherwise with same user account.
It is not possible during the PAM authentication -- the pam does not have any information about commands passed to the ssh. Only the ssh server can distinguish these types. But note that not passing the command argument to ssh means it internally executes the user shell (usually bash).
You can achieve what you describe by using the following in your
sshd_config as already proposed by muru:
Match testuser ForceCommand /bin/bash -il
This will always run interactive shell for user, even if he specifies the command argument to ssh. If you rather want to show some message in case there is different command passed, you will have to write some simple script, which will be called instead of the bash and will check the
SSH_ORIGINAL_COMMAND and if that is set, do appropriate action of your choice.