Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is there a method to restrict SSH users to certain access rights for certain programs (such as Python, Perl, Ruby, Java, etc), but also a method to restrict them from leaving their /home/ directories?

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

Well, if you want to restrict a user to /home, ssh is not really the right tool. For example, /bin/bash is not in /home. A better tool would be something like NFS, sshfs, ftp, etc (we could debate which one to use).

You could build a chroot in /home, but LXC is, IMO, a better more modern tool.

Your other option would be to write an apparmor profile. This would be somewhat similar to a chroot in that you would need to specify what a user would and would not have access to in a profile.

What you would do is make a link to /bin/bash , I call it jailbash

sudo ln /bin/bash /usr/local/jailbash

You then change the users log in shell from bash to jailbash

sudo chsh <user>

Now write an apparmor profile for jailbash:

Here is an example :

http://bodhizazen.net/aa-profiles/bodhizazen/ubuntu-10.04/usr.local.bin.jailbash

It is written for Ubuntu 10.04, and you will need to review an update it, but it gives you a starting point.

share|improve this answer
    
Given that this is on a shell server, i need to at least get restrictions done for programs, would you recommend apparmor profiles, or LXC, for a low-spec shells server? –  Thomas W. May 30 '12 at 17:40
    
Hard to answer your question without more details on what you want your users to do. In general, Apparmor if your users need to interact with the main system (start/stop services, edit config files, manage web content, backups, etc) and LXC if they need only ssh/shell access (sshfs, port forwarding). –  bodhi.zazen May 30 '12 at 17:57
    
the ssh/shell access is all they'd need, but i'd like to restrict the running of non-admin-installed python programs, i.e. python ./IAmAScript.py, from the shell. –  Thomas W. May 30 '12 at 18:10
    
My advice would be to use apparmor. –  bodhi.zazen May 30 '12 at 18:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.