How to handle scp connection with custom command

Darren Tucker dtucker at
Sat Aug 26 20:32:50 AEST 2017

On 26 August 2017 at 17:51, <ryan at> wrote:

> Hi, everyone
> I’m developing an internal bastion system for my company.
> It synchronize ssh public keys to ‘~/.ssh/authorized_keys’ and set
> ‘COMMAND’ option to attach different Docker container for different user.
> Basically something like this:
> restrict,pty,command=“/usr/bin/docker exec -ti bunker-1-ryan /bin/bash"
> ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQg401lnhl+hNzFpESjN+XvBkR/
> swIaHYP1no8lmcUJB25OF5ZP6vAN4Nh2EqULqUQ8tSpuFzistO+SwIn10OM8bzAy/
> OEWoHQUcjvJ1aS4kyZi9HKmfj66K7Mnm78Q7uc1jiDAzn0aZkQzR7hVj0jSX
> RXD68Q7el3DllgunyfsQs4yXroAFHO6g+mcO8jd71jZx0nB3dpnSlqJuFGl5nJl
> WoSaw6aTrW0wYdVk/YqpQtYGOGS/lzLvUj0eMIIYZ2w3L+
> ZVSFPcWkgf80TPVvQD6kmlWcbStR4xNW2dmL09WlYH+SLPu4BCvvPU0vCO83Y+u2qSqBTRKA/S0Xm0Nx1
> ryan at
> But the problem is ‘scp' does not work, I wonder how to handle ‘scp'
> requests with custom COMMAND option.

scp sends the command "scp -t [args]" (see [1]) the remote end and your
forced command is not going to allow running non-interactive commands like


Darren Tucker (dtucker at
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

More information about the openssh-unix-dev mailing list