OpenSSH version 4.9 fixed an issue that allowed local users with write access to their ~/.ssh/rc file to override administratively set ForceCommand, possibly bypassing intended security restrictions. References: http://marc.info/?l=openssh-unix-dev&m=120692745026265&w=2 http://secunia.com/advisories/29602/ http://openbsd.org/errata43.html#001_openssh ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/001_openssh.patch
Affects only F7, F8 & Rawhide.
Tomas is obviously right. ForceCommand directive was introduced in OpenSSH version 4.4 (http://openssh.org/txt/release-4.4): Changes since OpenSSH 4.3: ============================ [...] * Added a "ForceCommand" directive to sshd_config(5). Similar to the command="..." option accepted in ~/.ssh/authorized_keys, this forces the execution of the specified command regardless of what the user requested. This is very useful in conjunction with the new "Match" option. Therefore, this issue did not affect versions of openssh packages as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and 5.