Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 5 down vote favorite
1

I'm trying to make a user that can access my server through SSH and allow it to have a shell, limited to using only, say screen and irssi. And it shouldn't it be able to see other directories except it's home folder and sub directories within it. And the usage of memory/cpu should be limited to a certain amount. How should I go about implementing it on a Centos 6.1 server?

share|improve this question
1  
Virtualization is the way to go; chroot only provides very limited security (no restriction on network, CPU or memory usage). I don't know what virtualization options are available out-of-the-box on CentOS . – Gilles Dec 17 '11 at 22:25
For limiting memory / cpu usage, maybe look into PAM limits settings. Also, screen can contain any shell and run any command, so are you saying you only want the user to be able to run a persistent irssi instance? – jw013 Dec 21 '11 at 2:32
@jw013 not exactly, I just want to restrict the user to use only the commands I provide, the example of screen and irssi - so that they couldn't self compile programs and such, and that they don't over use the resources of the computer. – Maverick Dec 23 '11 at 11:36

2 Answers

up vote 6 down vote accepted

Use use the "command" directive from the ssh authorized_keys file, and/or specify that a restricted shell (/bin/rsh) should be used for the user. The o'reilly ssh book is a key reference guide (no pun intended); or google for "restricted shell", "ssh authorization file". Some references:

  • an example or two showing how invoke a custom command (or script) when you ssh into a box
  • an example showing a whole set of recommendations for restricting access
  • another s.o. example for a very similar question (the orig question is suspect, but a lot of good answers)

Anyway, this is sort of a meta-answer pointing to other answers, but the key really is using the authorization file and specifying the command(s) that are allowed to be executed on the remote host, and/or using the restricted shell to limit access to the remote box.

share|improve this answer
thank you for the links. that should keep me busy for awhile. :) – Maverick Feb 11 '12 at 15:58
up vote 0 down vote

First of all check please ChrootUser in /etc/ssh/sshd_config it should jail Your users (there is specific version of OpenSSH needed for that).

Second method is to install some jail software. I'm using jailkit on some servers and it's giving me all what I need.

Third possibility is probably grsec if it's still in development. :-)

share|improve this answer
Thanks! I'll look into those! :) – Maverick Dec 19 '11 at 5:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.