---
title: Defining Prompt-Based Command Policies for SSH Connections
slug: kronpam-reference-guide-3-9-0/defining-prompt-based-command-policies-for-ssh-connections
docTags:
createdAt: 2026-10-07T11:05:04.193Z
---
Prompt-based identification on the Kron PAM SSH Proxy allows or blocks users from executing commands on the device connected to. This ensures that unauthorized users are prevented from executing any commands.
For example, you can define a rule that allows the root user to establish an SSH connection to a device but prevents other users from executing the ssh command.
First, we need to explain what we mean by the “**prompt**.” The prompt is the part of the screen that appears when you connect to a device and waits for you to enter a command. After connecting to the device, it displays **your username**, the **server name,** and the **current directory**.
For example:
**\[John\@product-pam: \~]#**
Read this prompt as follows:
· **John** \:Username.
· **product-pam**:Server name.
· **\~** \:Current directory
· # \:Session type
:::hint{type="info"}
A **#** at the end indicates a **root **session, while a **$** at the end indicates a **regular user** session.
:::
A prompt-based policy reads the content of this prompt to determine the environment of the session. To define an environment, you write a pattern that matches the prompt of that environment. For example, a prompt that contains root@ identifies a root session.
**How to Write a Rule **
A rule, called a **Policy Key**, consists of two parts: the prompt part and the command part.
User can define in the following format:
**\ PROMPT\_PATTERN \ COMMAND\_PATTERN **
· **\ ...\** between these tags, user should write the prompt pattern that defines the environment where the rule applies.
· **\ **after this tag, user should write the command pattern that you want to target
:::hint{type="info"}
The closing tag must include a slash (). If you write both tags as , the rule does not work.
:::
**Example**: Allow the root user to run ssh, and block all other users.
Define the following rule as a Black Key, that is, a rule that blocks the matching command:
**\**(**?!.\*root@).\*\ssh.\***
Read the rule part by part:
· **(?!.\*root@).\*** — ***the prompt part***. It matches prompts that do not contain root@, that is, non-root (normal) user sessions. The leading (?!...) expression means “match what does not contain this.”
· **ssh.\*** — ***the command part***. It targets every command that starts with ssh. With this rule defined, a normal user who tries to run ssh is blocked, while the root user is not caught by the rule and runs the command freely.
| ***Session*** | ***Example Prompt*** | ***Result When Running ssh*** |
| ------------- | --------------------------- | ----------------------------- |
| *Root* | *\[root\@product-pam: \~]#* | *Allowed* |
| *normalUser* | *\[John\@product-pam: \~]#* | *Blocked* |
**How to Define Prompt Based Policy in Kron PAM **
To define the Prompt Based Policy in Kron PAM, follow these steps:
1. Navigate to **Policy > Policy Keys**
2. **Click **the Add button, select **Black Key** as the **Policy Key Type**, then click **Next**
3. On the screen that opens, add the prompt rule to the Black Key Regex the following format:
\**PROMPT\_PATTERN**\**COMMAND\_PATTERN**
4. Click the **Save** button to complete the operation
5. Add the Relevant Policy Key Value to the Policy Group that you want to define or update.
6. In the Realm definition, specify which user group and device group the command-based restriction applies to.
7. An SSH connection is established to the user and device group defined in the realm. The ssh command is executed using the **John** user, as defined in the example above. It is observed that the operation does not occur when this username is used to execute the command.
8. If you switch to the **root** user and run the ssh command again, you will see that the operation is performed for that user.
