I'd like to use a passwordless key to perform e.g. unison synchronization while being able to SSH into the server only with a password-protected key. The usual way of using scponly is changig the login-shell of my server account, but that is too global. Can an entry in authorized_keys achieve this instead?

1 Answer 1


You can use command keyword in authorized_keys to restrict execution to one single command for particular key, like this:

command="/usr/local/bin/mysync" ...sync public key... 

Update: If you specify a simple script as the command you may verify the command user originally supplied:


/path/to/unison *) 
echo "Rejected" 
  • Doesn't that simply execute that command? I'd like sshd to only allow a ssh server -c unison ... while any other attempt to connect with that key should not execute anything but simple refuse connecting Nov 14, 2012 at 8:32
  • It is possible, I updated the answer. But what the reason for such behavior? If you have the key you have permission to sync. So you rather connect and do the job or don't connect at all... Nov 14, 2012 at 9:13
  • Perfect, I used case "$(basename $SSH_ORIGINAL_COMMAND)" in \n unison *) though. The reason is I want to have a private key that doesn't require a password so unison can run unattended (e.g. as a cronjob), while that key should not be capable of allowing a SSH access. Of course unison could be abused to replace authorized_keys... Nov 14, 2012 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.