--- servconf.c.orig	2007-05-16 13:38:13.000000000 +0200
+++ servconf.c	2007-05-16 14:21:47.000000000 +0200
@@ -122,6 +122,7 @@
 	options->permit_tun = -1;
 	options->num_permitted_opens = -1;
 	options->adm_forced_command = NULL;
+	options->no_forced_command = 0;
 }
 
 void
@@ -291,7 +292,7 @@
 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
 	sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
 	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
-	sMatch, sPermitOpen, sForceCommand,
+	sMatch, sPermitOpen, sForceCommand, sNoForceCommand,
 	sUsePrivilegeSeparation,
 	sDeprecated, sUnsupported
 } ServerOpCodes;
@@ -403,6 +404,7 @@
  	{ "match", sMatch, SSHCFG_ALL },
 	{ "permitopen", sPermitOpen, SSHCFG_ALL },
 	{ "forcecommand", sForceCommand, SSHCFG_ALL },
+	{ "noforcecommand", sNoForceCommand, SSHCFG_ALL },
 	{ NULL, sBadOption, 0 }
 };
 
@@ -1249,10 +1251,21 @@
 			fatal("%.200s line %d: Missing argument.", filename,
 			    linenum);
 		len = strspn(cp, WHITESPACE);
-		if (*activep && options->adm_forced_command == NULL)
+		if (*activep && options->adm_forced_command == NULL) {
 			options->adm_forced_command = xstrdup(cp + len);
+			options->no_forced_command = 0;
+		}
 		return 0;
 
+	case sNoForceCommand:
+		if (*activep) {
+			if (options->adm_forced_command != NULL)
+				xfree(options->adm_forced_command);
+			options->adm_forced_command = NULL;
+			options->no_forced_command = 1;
+		}
+		break;
+
 	case sDeprecated:
 		logit("%s line %d: Deprecated option %s",
 		    filename, linenum, arg);
@@ -1332,6 +1345,11 @@
 			xfree(dst->adm_forced_command);
 		dst->adm_forced_command = src->adm_forced_command;
 	}
+	if (src->no_forced_command) {
+		if (dst->adm_forced_command != NULL)
+			xfree(dst->adm_forced_command);
+		dst->adm_forced_command = NULL;
+	}
 	if (src->x11_display_offset != -1)
 		dst->x11_display_offset = src->x11_display_offset;
 	if (src->x11_forwarding != -1)

--- servconf.h.orig	2007-05-16 14:18:52.000000000 +0200
+++ servconf.h	2007-05-16 14:19:26.000000000 +0200
@@ -135,6 +135,7 @@
 	char   *authorized_keys_file2;
 
 	char   *adm_forced_command;
+	int	no_forced_command;
 
 	int	use_pam;		/* Enable auth via PAM */
 
