The OpenSSH documentation has everything you need for this, in man 8 sshd. By disabling all forwarding, and forcing a specific command to be executed, it is possible to heavily lock-down key-based SSH. Such options can be specific to an individual SSH key, and need not be system-wide.

Yes, sure... I know how to do it because I'm using it all the time to lock down access by key, e.g. for backup access. All that's needed would be an example of which command systemctl -H ... actually sends to the SSH host (for both variants ... -H host/machine and ... -H host).

Actually, most other software has an example for this, i.e. borgbackup has an example. They don't say man 8 sshd has everything you need.

and forcing a specific command to be executed

Ah yes, here we are: Define "specific command".

Thanks. :-)

i'm pretty sure it's "systemd-stdio-bridge" which is used to connect it directly to dbus, but please check the source to make sure...

Okay, that's a starting point at least. I'll look into it and maybe create a patch for documentation. Thanks.

Yes something like this:

from="192.168.1.0/24",command="/usr/bin/systemd-stdio-bridge",no-port-forwarding,no-X11-forwarding,no-pty ssh-rsa ...

By coincidence, I found it's running ssh -xT -- HOSTNAME systemd-stdio-bridge --machine=MACHINENAME.

I can't understand what are you people saying 😥😥

Please tell me how could i learn this