Ubuntu Server 16.04.1 x64. Mounts - /boot, /, /home I have example user1

Can I restrict the user1 to run the only 2 or 3 programs via SSH only in user1 home directory (/home/user1), and disable the ability to navigate through the folder /bin, /etc, /var, /tmp, /boot and other.

I need to allow the user1 to run only - screen, unzip, top, java

And deny to run any other commands (rm, cp, mv and others)

Deny to cd above its catalog. Deny delete, or copy any file from /etc to /home/user1 directory.

  • I would search for creating a Chroot environment, it's not exact, however it might solve your need. – user508889 Feb 4 '17 at 17:34
  • Indeed a difficult question to implement. Did you look at Lshell in the Ubuntu software channels ? – albert j Feb 4 '17 at 17:37

As long as you enable java, user can compile something more complicated that escapes your restrictions. E.g. even vi can be used to escape restricted shell. Well, vi is not written in java but same idea...

Chroot and it is not intended to be a security measure, there are programs that can let you escape chroot if you are root. I think the best you can do is to create some minimal system in chroot and create unprivileged user inside (so it will have it's own /chroot/etc, /chroot/usr that will be accessible to user.

  • @Nail, also note that "command=" in .ssh/authorized_keys file might be helpful. I use it e.g. to allow just btrfs but when you don't have any access to the shell, isolating user is easier – Andrius Štikonas Feb 4 '17 at 18:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.