Hi all

I've recently noticed that it's quite tricky to get a remote OpenSSH command to be invoked with the correct arguments, especially if using a command= specifier in a public key entry with "$SSH_ORIGINAL_COMMAND".

When ssh is invoked, any argument quoting is consumed by the calling shell. ssh then passes the command to sshd, where it's stored in SSH_ORIGINAL_COMMAND. However, no escaping is performed by ssh or sshd to ensure that shell metacharacters are escaped and whitespace regions within arguments aren't treated as argument separators.

In a normal shell, one uses "$@", which is the argument-separation-and-metachar aware version of "$*".

OpenSSH lacks any equivalent. It needs one to make it possible to use SSH_ORIGINAL_COMMAND securely without making arbitrary rules ("the command may not contain any shell metachars and spaces within arguments are not permitted").

It really needs a $SSH_ESCAPED_ORIGINAL_COMMAND .