Restricting SSH users to certain access permissions

Question

Is there a method to restrict SSH users to certain access rights for certain programs (such as Python, Perl, Ruby, Java, etc), but also a method to restrict them from leaving their /home/ directories?

Answer 1

Well, if you want to restrict a user to /home, ssh is not really the right tool. For example, /bin/bash is not in /home. A better tool would be something like NFS, sshfs, ftp, etc (we could debate which one to use).

You could build a chroot in /home, but LXC is, IMO, a better more modern tool.

Your other option would be to write an apparmor profile. This would be somewhat similar to a chroot in that you would need to specify what a user would and would not have access to in a profile.

What you would do is make a link to /bin/bash , I call it jailbash

sudo ln /bin/bash /usr/local/jailbash

You then change the users log in shell from bash to jailbash

sudo chsh <user>

Now write an apparmor profile for jailbash:

Here is an example :

http://bodhizazen.net/aa-profiles/bodhizazen/ubuntu-10.04/usr.local.bin.jailbash

It is written for Ubuntu 10.04, and you will need to review an update it, but it gives you a starting point.