It is possible that /bin/sh may be a special case in newer versions of the SSH server or you have some other configuration acting as a "safety net" in your case. I still would not recommend depending on this; you should be using the "forced command" option on the public key to ensure that it can only be used to run your program and you still need to read perlsec and make sure that your program cannot be exploited into a shell-equivalent if this is an actual security issue.
|