During authentication of SSH user, is there a way we can tell between SSH session vs SSH inline command? I have tried checking tty but they are coming up the same in both cases for me. In my scenario, I need a way to block user (during authentication) from doing "ssh user@hostname 'some cmd'" but allow the user to log in via SSH otherwise with same user account.

  • 1
    Why do you need PAM there? Just have a ForceCommand /bin/bash -il in sshd_config.
    – muru
    Sep 26 '19 at 8:45
  • 1
    Why do you even want to do this? Do you think there's some security benefit? (there isn't). Or do you just hate your users and want to make things difficult for them?
    – cas
    Sep 26 '19 at 11:49
  • Do you also want to prevent users from using scp or sftp?
    – Kenster
    Sep 27 '19 at 1:46

It is not possible during the PAM authentication -- the pam does not have any information about commands passed to the ssh. Only the ssh server can distinguish these types. But note that not passing the command argument to ssh means it internally executes the user shell (usually bash).

You can achieve what you describe by using the following in your sshd_config as already proposed by muru:

Match testuser
  ForceCommand /bin/bash -il

This will always run interactive shell for user, even if he specifies the command argument to ssh. If you rather want to show some message in case there is different command passed, you will have to write some simple script, which will be called instead of the bash and will check the SSH_ORIGINAL_COMMAND and if that is set, do appropriate action of your choice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.