SSH - How to force execution of a script ( /etc/sshrc , ForceCommand, .. ? ) on login but still allow execution of the client's ~/.ssh/rc?

13,310

The solution seems to be to evaluate the

SSH_ORIGINAL_COMMAND

environment variable that gets set to the command in the client's ~/.ssh/rc inside the script configured as ForceCommand.

I found this possible solution in this answer.


Remaining: Is there a way to override the ~/.ssh/rc location using an environment variable?

Share:
13,310
Nicolai Fröhlich
Author by

Nicolai Fröhlich

Updated on September 18, 2022

Comments

  • Nicolai Fröhlich
    Nicolai Fröhlich almost 2 years

    As far as i know upon SSH login the following files are executed

    [SERVER] /etc/environment
    
    [Client] ~/.ssh/environment
    -> can be locally overriden by "SSH_ENV" environment variable
    -> will override Host=>SendEnv in local ~/.ssh/config
    -> will be filtered by "AcceptEnv" directive(s) in remote /etc/ssh/sshd_config
    -> will NOT be used if "PermitUserEnvironment no" in remote /etc/ssh/sshd_config
    
    [SERVER] /etc/ssh/sshrc         
    -> will NOT get executed if "ForceCommand" exists in remote /etc/ssh/sshd_config
    -> will NOT get executed if local ~/.ssh/rc exists
    -> can be overriden by "ForceCommand" (kind of)
    
    [Client] ~/.ssh/rc              
    -> will NOT get executed if "ForceCommand" is configured
    -> can be overriden by local "???" environment variable?
    

    Question

    How can i force the execution of a script on the server but still allow the client to use his ~/.ssh/rc ?

    Bonus question

    Is it possible to override the local ~/.ssh/rc location using an environment variable? If yes which one?

    • Panther
      Panther over 10 years
      What are you trying to do with ~/.ssh/rc ? If you are going to force a command, perhaps call a script (from the corced command) and source ~/ssh/rc from the script.
    • Nicolai Fröhlich
      Nicolai Fröhlich over 10 years
      i can't source the client's ~/.ssh/rc from inside a remotely executed command, can i ?