ssh certificate's force_command is lost if there is a force_command in sshd_config

Cyril Servant cyril.servant at cea.fr
Wed Oct 15 23:43:34 AEDT 2025


Hello,

when a force_command is present in sshd_config _and_ another in an SSH 
certificate, the one in sshd_config is used. This is completely normal 
and expected.

Similarly, the SSH_ORIGINAL_COMMAND environment variable contains the 
original command.

Unfortunately, the value of the command in the certificate is lost.

Do you think it would be possible to add an SSH_CERTIFICATE_COMMAND 
environment variable in this specific case? Indeed, a sysadmin may want 
to take into account the command from the certificate rather than the 
original command.

Thank you,
-- 
Cyril


More information about the openssh-unix-dev mailing list