I have used the ~/.ssh/authorized_keys file with OpenSSH for ages. However, I always treated it as just a dumb list of keys, where I would dump my public key whenever I needed access to a new account or host.
But today I learned from this blog entry that there is a bit more to it. Details are available from `man 8 sshd'.
Basically, each key can be prefixed by a list of options which restrict the kind of access granted to a connection attempt providing the given key.
Of particular interest is the command="/usr/local/bin/foobar" option. This makes sshd run the given command on connect, disabling the normal login shell or direct execution of commands supplied by the remote user. There are also a few further options for disabling port forwarding, …
[Read more]