ssh-guard is a restricted SSH command guard. When a user connects, OpenSSH passes the command they typed in the environment variable. ssh-guard reads that variable, matches it against a rule tree you define in a TOML config, and only runs the command if it matches an allowed rule.
Every attempt, logged and tested against your rules, keeping a trace of accountability be it a failure or success.
- Reads the command from
SSH_ORIGINAL_COMMAND. If the variable is unset, ssh-guard exits with an error. - If the command is empty, it prints the configured
help_textand exits0. - Commands are matched against rules. A match runs the command; a non-match is denied, everything is logged.
- Rules can be scoped to profiles so different SSH users get different allowed commands.
- All actions are audited.
- MANUAL_SETUP.md: How to install and configure ssh-guard on any Linux distribution.
- NIXOS_SETUP.md: How to install and configure ssh-guard on NixOS.
- CONFIGURATION.md: How to write rules and configure ssh-guard.
- SECURITY.md: Security considerations for deploying ssh-guard.
- TROUBLESHOOTING.md: Common problems and how to fix them.