Home / server / Questions / 166143
Accepted
Weboide
Asked: 2010-08-02 17:00:51 +0800 CST

equivalent option to "no-user-rc" for sshd_config?

  • 772

Is there an option similar to no-user-rc that I can use in sshd_config?

I want to prevent from executing the ~/.ssh/rc file for everybody (whether logging in using a password or key).

Using Openssh 5.3p1.

ssh

1 Answers

  1. Best Answer

    If restricting everyone to using authorized keys only is not an option, you can use the ForceCommand directive in sshd_config to achieve what you want (Openssh 4.9 or later). See OpenSSH Security:

    OpenSSH 4.9 and newer do not execute ~/.ssh/rc for sessions whose command has been overridden with a sshd_config(5) ForceCommand directive. This was a documented, but unsafe behaviour (described in OpenSSH 4.9 release notes).

    The patch notes for OpenSSH 4.9 state the following regarding ForceCommand:

    Disable execution of ~/.ssh/rc for sessions where a command has been forced by the sshd_config ForceCommand directive. Users who had write access to this file could use it to execute abritrary commands. This behaviour was documented, but was an unsafe default and an extra hassle for administrators.

    One suggestion would be to use the solution proposed in this thread "ForceCommand and ~/.ssh/rc".

    • 1