Put the command boundary on every destination host, not only in the AI agent’s prompt or tool settings. A dedicated low-privilege account with an OpenSSH forced command can route each connection through a small dispatcher that accepts only explicitly allowed operations. Disable SSH features the task does not need, and keep each host’s policy and credentials scoped to that host.
What a per-host command allowlist does—and does not do
An SSH command allowlist decides what an authenticated account may ask a particular server to do. It is enforced at the destination: OpenSSH replaces the client’s requested command with a designated command, and that program decides whether the request matches an allowed operation.
As an Amazon Associate I earn from qualifying purchases.
This is different from a prompt restriction. A prompt can tell an agent not to run a command, but it does not prevent an authenticated credential from requesting one. If the host accepts that credential with a broader shell or another usable access path, the prompt is not an access-control boundary.
Recommended Free Tools
OpenSSH agent destination constraints solve another problem. They can limit where an agent-held key may authenticate, including permitted forwarding paths, but they do not decide which commands the authenticated account may execute. Use destination constraints as an additional limit on credential use, not as a replacement for server-side command policy.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose the enforcement design
| Design | What it controls | When it fits |
|---|---|---|
| Forced command on the destination account | Replaces the requested command with a fixed program; the program can accept or reject a narrow set of requests. | A single operation or small per-host allowlist. |
| SSH gateway | Centralizes access policy and can provide a common control point for multiple destinations. | When centralized policy visibility is worth the gateway dependency and operational complexity. |
| Client-side agent-tool policy | Shapes what the agent tool offers or requests, but does not constrain a host that accepts the same credential through a broader path. | As a usability layer alongside destination-side enforcement, not as the host’s security boundary. |
| General shell access | Allows a much wider range of commands than an enumerated dispatcher. | Generally unsuitable for a narrowly scoped agent account. |
For a static, single-purpose task, one forced command may be enough. For several operations, a small dispatcher with a strict interface is easier to audit than an expanding shell case statement. If tasks need broad, changing command flexibility, consider an explicitly designed service interface with named methods and audit records rather than a general shell.
Build the boundary on each destination host
- Create a dedicated account. Give it no unrelated role and only the filesystem, process, and network permissions its operations need. Do not use routine root login for agent work.
- Choose the permitted operations for this host. For example, a monitoring host might expose status and bounded log retrieval, while a deployment host might expose only a specific deployment wrapper. Do not assume one shared allowlist is appropriate everywhere.
- Install a trusted forced-command program. OpenSSH supports a
command="..."option inauthorized_keysandForceCommandinsshd_config. The key option is useful for a key-specific policy; a user-scoped server configuration can apply a policy to the account. Select the mechanism that matches how the account’s keys are managed. - Make the dispatcher the only interface. With a forced command, OpenSSH provides the client’s original requested command in
SSH_ORIGINAL_COMMAND. Treat that value as untrusted input. Accept only a documented grammar of operation names and validated arguments, map each operation to a fixed executable path, and reject everything else. - Remove other access paths. Disable unneeded forwarding, PTY allocation, file-transfer or subsystem access, user startup hooks, and environment changes. Check the account’s key options, server configuration, permissions, and any privilege rules as one policy rather than assuming the dispatcher is the only relevant control.
- Test on the deployed system. Check accepted and rejected requests, the account’s effective permissions, and alternate SSH features using the installed OpenSSH release and the operating system’s local documentation.
Design a strict dispatcher interface
Keep the interface small enough that an operator can tell exactly what a request will do. For example, a monitoring account could accept the operation names status and logs, with a fixed service name and a bounded line count for log retrieval. These are illustrative operation names, not commands to paste as a universal configuration.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Allow only enumerated operation names; reject unknown names and extra arguments.
- Validate each argument’s type, length, and allowed values. Bound quantities such as log-line counts.
- Call fixed executable paths with argument arrays. Do not use
eval, construct shell command strings, or interpolate agent-provided text into a shell. - Set a controlled environment and avoid inheriting variables that could change program behavior.
- Keep dispatcher code and its configuration unwritable by the agent account. Review the permissions of every script, executable, and file it invokes.
- Return only the output the operation needs to provide; do not turn arbitrary natural-language text from the agent into shell input.
SSH_ORIGINAL_COMMAND is a command string, not a trusted, already-validated argument list. If parsing is necessary, define a narrow grammar and reject shell syntax, unexpected quoting, separators, and other input outside that grammar. A purpose-built parser is safer to reason about than ad hoc shell splitting. For a single fixed operation, avoid parsing a request at all if the design can make the operation itself static.
A forced command is not a general-purpose sandbox. It runs with the account’s operating-system permissions, so a dispatcher that can write sensitive files, invoke an unrestricted privilege rule, or execute a writable script can still expose more than intended. If an operation needs elevated privileges, expose a narrow fixed wrapper through a separately controlled privilege boundary rather than giving the account broad administrative access.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Disable SSH capabilities the task does not need
The OpenSSH authorized-key option restrict disables port forwarding, agent forwarding, X11 forwarding, PTY allocation, and execution of the user’s SSH rc file. The OpenSSH manual’s example combines restrict with a forced command=. Add an exception only when a task requires that capability, and record why it is needed: re-enabling a feature restores an access path beyond the dispatcher’s operation list.
Review the rest of the connection policy as well. ANSSI’s 17 August 2015 OpenSSH security note recommends limiting users to necessary commands, restricting network exposure to the management path where practical, and denying user-controlled environment changes by default while selecting any accepted variables case by case. A command dispatcher does not itself limit network reachability or neutralize every other SSH feature.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Also inspect file-transfer and subsystem behavior, the account’s shell and startup configuration, writable scripts, and any sudo rules. A command allowlist is only as narrow as the other ways the same login can act.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep policies and credentials host-specific
“Per-host” should mean that each destination makes its own authorization decision. A credential accepted on a monitoring server should not automatically grant the same operations on a deployment server.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
- Use a distinct account or credential for each host and purpose where practical.
- Grant only the operations that host needs; avoid a shared credential that silently expands the blast radius across machines.
- Record accepted and rejected requests with enough context to identify the agent or key, host, account, operation, and outcome. Protect logs and avoid recording secrets embedded in input.
- Keep file-transfer access disabled unless the task requires it, and then constrain that route separately.
- Review the policy when tasks, scripts, or OpenSSH versions change; a previously safe wrapper can become broader as its dependencies evolve.
Use agent destination constraints as a second layer
OpenSSH’s ssh-add -h destination constraints can restrict where a key held by ssh-agent may authenticate and which forwarding paths are permitted. They rely on host keys associated with known_hosts, so host naming, canonicalization, and key rotation must be maintained correctly. OpenSSH also notes that compatible agent, client, and server protocol support is required, with limitations around forwarded-agent trust and tools that do not cooperate with the constraint mechanism.
These constraints limit credential use during authentication; they do not transform a shell-capable account into a command-limited account. Keep the destination’s forced-command policy in place independently.
Account for platform and version differences
Do not assume a configuration behaves identically across distributions or OpenSSH releases. OpenSSH release notes include a fix related to complete application of authorized-key restrict to tunnel forwarding, illustrating why security-sensitive settings should be checked against the installed version’s documentation and release notes.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Windows OpenSSH has platform-specific details. Microsoft Learn documents the Windows authorized-key file location and restrictive permissions for administrator authorized keys. It also states that ChrootDirectory applies to SFTP sessions, not remote cmd.exe sessions, and uses a forced internal-sftp command for an SFTP-only chroot. That SFTP arrangement is not a general shell sandbox.
Verify the policy before relying on it
- Confirm that the intended account and key reach the forced command on the target host.
- Try each allowed operation with valid and invalid arguments, then try an unknown operation and an unexpected command string; rejected requests should not fall through to a shell.
- Check that PTY, forwarding, agent forwarding, X11, file transfer, and other unneeded capabilities are unavailable.
- Verify that the account cannot modify the dispatcher, its configuration, or programs it invokes, and cannot use another privilege route to exceed the intended scope.
- Confirm that logs capture both successful and rejected requests without exposing credentials or other sensitive input.
The exact checks depend on the operating system, OpenSSH release, shell, account configuration, and operation semantics. The OpenSSH manual, ANSSI’s guidance, Microsoft’s Windows documentation, and the release notes describe relevant behavior, but no single generic configuration establishes a safe boundary for every deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
