Bashrc disable-ing all but a given command for a given user

Question

Is it possible to have bashrc grab every single command the user types, save for those containing a given word?

Like the way you can use aliases to change what the user meant, you can alias for instance 'cd' to nothing. that way the user can't apply that command anymore.

Maybe that way you can have a given user only able to apply one command?

possible duplicate of Can I restrict a user to use special programs? — jasonwryan, Aug 20 '13 at 22:19
I don't think this is a duplicate; that question is more focused on graphical applications, whereas this one is explicitly about terminal programs. — evilsoup, Aug 20 '13 at 23:05

score 2 · Accepted Answer · edited Apr 13 '17 at 12:36

2

If you only need users to access files remotely with sftp or rsync, but not be able to run shell commands, then use rssh or scponly.

If you need users to be able to run only a few programs, set a restricted shell for them, such as rbash or rksh. In a restricted shell, PATH cannot be changed and only programs in the path can be executed. Beware not to allow programs that allow the user to run other programs, such as the ! or | command in vi. Access to files remains controlled by the file permissions.

edited Apr 13 '17 at 12:36

Community

1

answered Aug 21 '13 at 00:25

Gilles 'SO- stop being evil'

829,060

Ok this rssh stuff is absolutely brilliant. But is there any way to limit the rsync'ing to only the home folder of this limited rssh account? – john-jones Aug 21 '13 at 13:46
1

@HermannIngjaldsson Yes, though it does take a bit of manual setup. See the CHROOT file in the rssh documentation. – Gilles 'SO- stop being evil' Aug 21 '13 at 13:46
What do you think about restricting clients access via ssh-keygen as talked about here by mdpc: http://unix.stackexchange.com/questions/87983/how-to-securely-allow-scp-but-not-ssh/88028#88028? – john-jones Aug 24 '13 at 18:53
@HermannIngjaldsson Restricting the command in authorized_keys? Yes, that's possible. It gives you finer control: you can have different keys allowing different commands. Filtering the command is tricky; it works well if you want e.g. to only allow sftp, less well if you also want to allow scp and rsync. – Gilles 'SO- stop being evil' Aug 24 '13 at 19:15
where is the CHROOT file in the rssh documentation? – john-jones Aug 24 '13 at 19:25
@HermannIngjaldsson It's in the source archive, and presumably your distribution installs it wherever it installs the documentation. For example, on Debian/Ubuntu/Mint/…, it's in /usr/share/doc/rssh. – Gilles 'SO- stop being evil' Aug 24 '13 at 19:41

score 1 · Answer 2 · answered Aug 20 '13 at 21:59

1

Some shells (ksh, f.e.) have restricted mode, in this mode they will not execute anything outside $PATH.

answered Aug 20 '13 at 21:59

sendmoreinfo

2,573

Bashrc disable-ing all but a given command for a given user

2 Answers2

Linked