What happens if the server’s OpenSSH is older?

An unknown option makes sshd ignore that line, so the key will not work at all rather than work unrestricted. Check the version with `ssh -V` on the server.

Can the forced command see what the client asked for?

Yes, in the `SSH_ORIGINAL_COMMAND` environment variable. Scripts that accept a few fixed operations read it and refuse anything else.

Does restrict stop someone getting a shell?

No. Without `command=`, the key can still run commands and, if the terminal is allowed, open a shell. Add a forced command for keys that should do one job.

Free tool · no account

Restricted authorized_keys entry builder

A key in authorized_keys can do anything its user can, from anywhere, forever - unless you say otherwise. Paste a public key and choose what it may do: which addresses it is accepted from, the one command it may run, when it stops working, and which forwarding stays on.

Public key

The contents of the .pub file.

Only from these addresses (from=)

Comma-separated IPs, CIDR blocks, or host patterns; ! excludes.

Only run this command (command=)

Whatever the client asks for, this runs instead.

Stop working after (expiry-time=)

Port forwarding only to (permitopen=)

host:port, comma-separated. Enables forwarding to these targets only.

Allow a terminal (pty)Allow port forwardingAllow agent forwardingAllow X11 forwarding

Paste a public key to build a restricted authorized_keys line for it.

Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.

Next step

Fewer keys in authorized_keys

With Shortspan, people do not each add a key to the server: its credential is registered once, brokered for each session, and every session is recorded against the person who opened it.

Create a free workspace See what Shortspan does

Start from restrict

The restrict option (OpenSSH 7.2 and later) turns off port, agent, and X11 forwarding, the terminal, and ~/.ssh/rc in one go - including restrictions added in future OpenSSH versions. The builder starts there and re-enables only what you tick.

Forced commands and source addresses

command= replaces whatever the client asks to run with one fixed command, which is how backup and deploy keys are kept to one job. from= accepts the key only from listed addresses or networks. Together they make a stolen key far less useful.

expiry-time= (OpenSSH 7.7 and later) makes the key stop working after a date, which suits contractors and temporary access.

Common questions

What happens if the server’s OpenSSH is older?: An unknown option makes sshd ignore that line, so the key will not work at all rather than work unrestricted. Check the version with ssh -V on the server.
Can the forced command see what the client asked for?: Yes, in the SSH_ORIGINAL_COMMAND environment variable. Scripts that accept a few fixed operations read it and refuse anything else.
Does restrict stop someone getting a shell?: No. Without command=, the key can still run commands and, if the terminal is allowed, open a shell. Add a forced command for keys that should do one job.

More free tools