ssh certificate's force_command is lost if there is a force_command in sshd_config
Cyril Servant
cyril.servant at cea.fr
Wed Oct 15 23:43:34 AEDT 2025
Hello,
when a force_command is present in sshd_config _and_ another in an SSH
certificate, the one in sshd_config is used. This is completely normal
and expected.
Similarly, the SSH_ORIGINAL_COMMAND environment variable contains the
original command.
Unfortunately, the value of the command in the certificate is lost.
Do you think it would be possible to add an SSH_CERTIFICATE_COMMAND
environment variable in this specific case? Indeed, a sysadmin may want
to take into account the command from the certificate rather than the
original command.
Thank you,
--
Cyril
More information about the openssh-unix-dev
mailing list