A dedicated server appliance accepts logins over ssh for one login account only which is authenticated using public keys only, and executes a command configured with ForceCommand.The login account may be used by multiple identities, each having their public key registered in authorized_keys.I want to pass a control token into the command for some of those public keys.I can use an environment variable for this with the environment= setting in authorized_keys. To do this, I need to enable PermitUserEnvironment which is a global option in sshd_config (it is not supported in a Match block).By enabling PermitUserEnvironment, it also becomes possible for clients to pass environment varables. However, I think this is safe because:only variables permitted on the server by AcceptEnv settings can be passed by the client.variables set in authorized_keys take precedence over those passed from a client.the only valid login launches a forced command, so there is no way to access an interactive shell where one could tweak the environment.And I therefore believe thatGiven that I will not use AcceptEnv, it should not be possible for a client to pass an environment variable.If I set a value to the variable on all public keys then it is impossible for the client to override it, even if (erroeously) permitted by AcceptEnv. Because there is no shell access, there is no other way for the environment to be modified.Is this a safe use of PermitUserEnvironment, or are there any other risks  that I haven't considered above?
Risk Assessment of SSH PermitUserEnvironment with ForceCommand
ssh;security