#!/bin/bash

set $SSH_ORIGINAL_COMMAND
 
case "$1" in
   ls)
     ;;
   scp)
     ;;
   /bin/scp)
     ;;
   rm)
     ;;
   /path/to/custom/command)
     ;;
   *)
     logger -s -t restricted-command -- "Invalid command $@"
     exit 1
     ;;
esac
 
logger -t restricted-command -- "Executing $@"
exec "$@"