What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To restrict an AI agent over SSH, enforce the command policy on each destination server: use a dedicated low-privilege account, a forced command or small dispatcher, and disable SSH features the task does not need. A prompt that says “only run these commands” is not an access-control boundary. OpenSSH agent destination constraints can limit where a key authenticates, but they do not limit what an authenticated account can execute.
Put the command boundary on the destination host
A restriction in an AI tool may help prevent accidental misuse, but it cannot protect a server that accepts a broader credential or provides another route to a shell. The destination host should decide which operations the account may perform.
OpenSSH provides two ways to force a command: the command="…" option on an entry in authorized_keys, and ForceCommand in the server configuration. The forced program runs instead of the command requested by the SSH client. For a single fixed operation, forcing that operation may be sufficient. For a short allowlist, a dedicated dispatcher can accept a small set of named operations and reject everything else.
Choose a narrow interface
When a forced command is used, the client’s original request is made available to the forced program as SSH_ORIGINAL_COMMAND. Treat it as untrusted input—not as a command to execute. The dispatcher should map enumerated operation names to fixed executable paths, validate each argument’s type, length, and allowed values, and invoke programs with argument arrays rather than building a shell command.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For example, an interface might accept only status or logs --service api, with the service name checked against a fixed list. It should reject an unknown operation, extra arguments, shell metacharacters, and malformed input. Do not pass an agent’s natural-language output to a shell, use eval, or interpolate untrusted text into a command string.
A key entry can force a dispatcher and disable several SSH capabilities:
restrict,command="/usr/local/sbin/agent-ssh-dispatch" ssh-ed25519 AAAA… agent-monitorThis illustrates the option structure, not a complete copy-and-paste key: replace the example key material and dispatcher path with values appropriate to the host, and verify the account’s authorized-key file and permissions for the operating system in use. The OpenSSH sshd(8) manual documents the forced-command and restrict options.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use a dispatcher only if it stays small and strict
A purpose-built dispatcher is easier to review than a long shell case statement, but it is still security-sensitive code. Keep its operation grammar small, avoid invoking a general shell, reject requests by default, and ensure the account cannot modify the dispatcher or the executables and scripts it calls. If the task set grows into a broad, changing interface, a narrowly designed service with explicit methods and audit records may be easier to govern than an expanding command parser.
Disable SSH capabilities the task does not require
A command allowlist is incomplete if the same account can use SSH forwarding, a PTY, a subsystem, or another enabled feature to obtain broader access. OpenSSH’s authorized-key option restrict disables port forwarding, agent forwarding, X11 forwarding, PTY allocation, and execution of the user’s SSH rc file. Re-enable an exception only when the operation needs it, and record what capability that exception restores.
For a server-wide or per-account policy, review the relevant sshd_config settings as well as the key entry. A per-user block can be structured along these lines:
Match User agent-monitor
ForceCommand /usr/local/sbin/agent-ssh-dispatch
PermitTTY no
AllowTcpForwarding no
AllowAgentForwarding no
X11Forwarding no
PermitUserRC no
PermitUserEnvironment noCheck that these directives are supported and have the intended effect in the installed OpenSSH release and operating system. Configuration elsewhere may affect the effective policy. Do not enable SFTP, SCP, or other subsystem access unless it is part of the required interface; a forced command or shell restriction should not be assumed to make every alternate SSH path harmless.
Keep the rest of the account contained
- Use a dedicated account with no unrelated administrative role, and prevent it from changing its dispatcher, scripts, or configuration.
- Deny user-controlled environment changes by default; allow only specific variables that the operation requires. ANSSI’s OpenSSH guidance recommends selecting accepted environment variables case by case.
- Limit connections to the management path and restrict which identities and source networks may connect where practical.
- Log accepted and rejected operations with enough context to identify the account, host, requested operation, and outcome. Avoid logging secrets or sensitive command output.
- Do not use routine root login for agent work. If a task needs elevated privileges, expose a narrowly defined operation through a separately controlled privilege boundary rather than granting the account a general-purpose root shell.
ANSSI’s 17 August 2015 OpenSSH security note states: “Users shall only execute strictly necessary commands.” Its recommendation describes forced commands as a way to limit compromised accounts to uses such as monitoring, simple administration, or retrieving script output.
Make each host’s allowlist independent
“Per-host” means the destination makes its own decision. A monitoring server might permit status checks and bounded log retrieval; a deployment server might permit only a specific deployment wrapper. Use separate accounts or credentials for different hosts and purposes where practical. Avoid a shared credential that turns compromise of one agent account into access across an entire fleet.
Central management can help distribute and audit policies, but the effective restriction must still exist at the destination or at a deliberately chosen enforcement gateway that every connection is required to pass through. A client-side agent setting alone does not prevent an accepted credential from taking a broader path.
| Design | Where policy is enforced | Useful when | Main trade-off |
|---|---|---|---|
| Forced command or dispatcher on each host | Destination SSH account | Operations differ by host and a small interface is practical | Policies and updates must be maintained across hosts |
| SSH gateway | Gateway through which connections are required to pass | Central visibility is valuable and the gateway can be made mandatory | Creates a dependency and does not replace host controls if direct access remains possible |
| Client-side agent policy only | AI tool or client | Reducing mistakes and improving usability | Does not enforce a restriction on a host that accepts broader access |
For any design, assess the command scope, credential blast radius, escape paths, operational burden, and audit trail. Specifically review forwarding, PTY allocation, file-transfer and subsystem access, user rc files, environment settings, writable scripts, and privilege-escalation rules.
Understand what agent destination constraints do—and do not do
OpenSSH’s ssh-add -h destination constraints can limit where a key held by ssh-agent may authenticate, including permitted forwarding paths. They rely on server host keys associated with known_hosts, so host-name mapping, canonicalization, and key rotation need to be maintained. OpenSSH documents compatibility requirements across the agent, client, and server, along with caveats involving forwarded-agent trust and tools that do not cooperate with the restrictions.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
These constraints govern key use for authentication; they do not turn the authenticated account into a command allowlist. Use them as an additional limit on where a credential can be used, alongside the destination’s forced command and account restrictions.
Check platform and version behavior before relying on a policy
Security-sensitive SSH behavior can depend on the installed OpenSSH release and the operating system’s configuration. OpenSSH release notes include a fix concerning complete application of authorized-key restrict to tunnel forwarding. Check the target system’s local sshd(8) manual, release notes, and effective server configuration rather than assuming every distribution behaves identically.
Windows OpenSSH has platform-specific constraints. Microsoft’s OpenSSH Server Configuration documentation says ChrootDirectory applies to SFTP sessions, not remote cmd.exe sessions, and shows ForceCommand internal-sftp for an SFTP-only chroot. That is an SFTP arrangement, not a general-purpose shell sandbox. Microsoft also documents the authorized-key file location and restrictive permissions for administrator authorized keys; confirm the correct path and permissions for the account type in use.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Deployment checklist
- Define operations: list the few exact tasks the agent needs for this host, and specify allowed arguments and expected output.
- Create a dedicated account: give it no unrelated role and no write access to its dispatcher or the programs and files those operations rely on.
- Enforce at the destination: configure a forced command through
authorized_keysorsshd_config, then make unknown requests fail closed. - Remove unused SSH capabilities: disable forwarding, PTY, user rc execution, environment changes, and subsystem or file-transfer paths unless explicitly required.
- Test the boundary: verify every allowed operation and argument, then try an interactive shell, an unknown command, extra arguments, forwarding, PTY allocation, and any enabled subsystem. Confirm each denied path is actually denied.
- Review operations and audit: confirm logs distinguish accepted from rejected requests, and revisit host-specific rules when tasks, accounts, or OpenSSH versions change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
