I have a requirement where I want that user of my C++ program is able to do passwordless ssh on to a particular machine but the same user should not be able to do ssh on the same machine through a normal terminal/shell.


On a Unix system you should make the program's executable setuid to that it can run ssh -i against an identity file otherwise inaccessible to a user running the program. That identity file would authenticate access to a remote machine.

  • I could not understand your answer fully, executable needs to do setuid to which uid?
    – Saurabh
    Jan 14 '13 at 8:27
  • @Saurabh setuid to a user you set up specifically to allow remote access to the particular machine in question.
    – Kyle Jones
    Jan 14 '13 at 8:29
  • No that is not an option, as I need to do ssh on to remote machine through my program only through that user's id.
    – Saurabh
    Jan 14 '13 at 8:31
  • @Saurabh What does your ssh care what user it is running as, as long as you use the right username@remotemachine?
    – Christian
    Jan 14 '13 at 10:43

You could hard code the SSH private key into programs source (or use a key chain - cleaner, easier to maintain), and then append the associated public key to the remote hosts authorized_keys file.


Use private key authentication and disable other authentication methods on the server.

Additionally you may use the ForceCommand directive in the sshd_config of the server to only allow the given command to run.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.