[semi-extrinsic]

Or in the authorized_keys file, prepend the public key with a specified command. This is then the only command that the user can execute when logging in with that particular key. To wit:

  command="/usr/bin/foo" ssh-ed25519 AAAA....

[kijin]

I suppose this will also lock the user out of sftp and scp? Because otherwise they might be able to edit the authorized_keys file and run any command.

[gerdesj]

"I suppose this will also lock the user out of sftp and scp?"

No it wont! The specified command might provide sftp, scp, telnet or stream a film.

[fragmede]

I stream a film at funky.nondeterministic.computer on port 22

[rovr138]

hah

made me laugh

[titaniumtown]

i had no idea about that, thank you!