Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I will be using Ubuntu Linux for this project.

For training of a particular application at a conference I need:

  1. To have each student be able to ssh into the same user account on a server
  2. Upon each login automatically put the user in separate isolated environments
  3. Each isolated environment includes the application, example config files, and the standard unix toolset (e.g. grep, awk, sort, uniq, etc.) However, access to an entire linux filesystem is fine too as long as the user can only damage his own isolated environment and not those of others.
  4. The virtual environments should be destroyed when the users SSH session ends

For #1 we would like to do the single user account so we don't have to deal with creating an account for each student and handing out the user names and passwords.

Does anyone know how I can meet these goals? Which technology e.g. LXC, Chroot, etc. is best for this? I've been toying with the idea of using .bash_profile and .bash_logout to handle the creation and destruction of these environments but not sure which technology is capable of creating the environments I need.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

With Docker you can do this very easily.

docker pull ubuntu

docker run -t -i ubuntu /bin/bash
# make your changes and then log out
docker commit $(docker ps -a -q | head -n 1) sandbox

cat > /usr/local/bin/sandbox <<EOF
#!/bin/sh
exec docker run -t -i --rm=true sandbox /bin/bash
EOF
chmod a+x /usr/local/bin/sandbox

echo /usr/local/bin/sandbox >> /etc/shells

useradd testuser -g docker -s /usr/local/bin/sandbox
passwd testuser

Whenever testuser logs in, they will be placed into an isolated container where they can't see anything outside it, not even the containers of other users.
The container will then be automatically removed when they log out.


Explanation:

docker pull ubuntu

Here we fetch the base image that we're going to work with. Docker provides standard images, and ubuntu is one of them.
 

docker run -t -i ubuntu /bin/bash
# make your changes and then log out

Here we launch a shell from the ubuntu image. Any changes you make will be preserved for your users.
You could also use a Dockerfile to build the image, but for a one time thing, I think this is simpler.
 

docker commit $(docker ps -a -q |  head -n 1) sandbox

Here we convert the last container that was run into a new image called sandbox.
 

cat > /usr/local/bin/sandbox <<EOF
#!/bin/sh
exec docker run -t -i --rm=true sandbox /bin/bash
EOF

This will be a fake shell that the user is forced to run on login. The script will launch them into a docker container which will automatically be cleaned up as soon as they log out.
 

chmod a+x /usr/local/bin/sandbox

I hope this is obvious :-)
 

echo /usr/local/bin/sandbox >> /etc/shells

This may not be required on your system, but on mine a shell cannot be a login shell unless it exists in /etc/shells.
 

useradd testuser -g docker -s /usr/local/bin/sandbox

We create a new user that with their shell set to a script we will create. The script will force them to launch into the sandbox container. They are a member of the docker group so that the user can launch a new container.
An alternative to putting the user in the docker group would be to grant them sudo permissions to a single command.
 

passwd testuser

I hope this is also obvious.
 

share|improve this answer
    
Thanks for the thorough answer. –  jonschipp Apr 25 at 22:02

You can use Firejail restricted shell. It basically attaches mount, PID, IPC and network namespaces to a regular bash session opened over SSH or telnet. The virtual environment is automatically destroyed upon logout. This is a small howto:

How to Restrict a Login Shell Using Linux Namespaces

share|improve this answer
    
Thanks for sharing. –  jonschipp May 13 at 23:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.