SSHD ForceCommand with xpra

[shunkica]

When users connect to my server they have a custom entry point script specified using SSHD ForceCommand.
This script sets up the environment for the user and then runs an X11 app. When the user closes the app their ssh session is terminated.

In order to speed up the app for the end user I am trying to leverage xpra. However, I can not figure out how to only allow the users to run the entry script/x11 app same as now, and not have any other access to the server.

When I do xpra start ssh://restricteduser:myserver this results in connection failed: all SSH remote proxy commands have failed - is xpra installed on the remote host? when there is a ForceCommand in sshd.

[totaam]

xpra start ssh://restricteduser:myserver

I assume you mean xpra start ssh://restricteduser@myserver?

That's because xpra needs to run a command on your server, one that is not your entry script.
You can run the client with -d ssh to see what it is.

---

FYI: Another way of preventing access to the host is to you use xpra's builtin ssh server. The downside is that the sessions have to be started in advance on the server.
By default, xpra's ssh connection handler does not allow commands to be executed at all. Only xpra protocol connections.