Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Creating a UNIX account which only executes one command

I am trying to setup a user account that only has as minimal rights as possible.

The user should be able to log in via SSH and then use the "su" command to get root access BUT nothing else.

Is this even possible? So no basic commands like "cd", "ls" or "mkdir" should be available! The user should only be able to see one empty folder and then be able to use the "su" command to get full system access of the real OS (if chroot is used to achieve this).

Any ideas how this could be achieved?

Thanks in advance!

share|improve this question

marked as duplicate by jasonwryan, Renan, sr_, uther, warl0ck Jan 20 '13 at 0:42

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

What's the point of locking down anything if you hand over root? – jordanm Jan 19 '13 at 19:34
up vote 5 down vote accepted

I would suggest allowing to connect only via public key. Then you can connect that public key with your own command by supplying it in ~/.ssh/authorized_keys like that:

command="/path/to/mycommand" ssh-rsa ...

Whenever the user logs into that account with that key your command is executed instead of the usual shell. That command can for example be a shell script, or even just something like su -.

That should do what you asked for. - But please think again, it that is really what you want.

share|improve this answer
Thanks for your answer! Maybe I wrote my question a bit unclear. Your answer is a way in the right direction - but not quite what I had in mind. The point of this should be the following: I already changed the sshd_config file so that root is not able to log in via SSH - but sometimes I need root access over SSH, therefore I created a user that should only be able to log in via SSH and then use the su command to give me full access. This is the only user that can connect via SSH and this specific user should be able to do as less as possible. Is this possible - or is another approach better? – Walter Isaac Jan 19 '13 at 20:20
That is perfectly fine. You use ssh to log in as that specific user. If you set up ssh as described, ssh automatically runs su for you which asks you for the root password. There is no shell in between, therefore you cannot run anything else with this setup. – michas Jan 19 '13 at 20:27
Ok! Fine! Thanks for your anwser! – Walter Isaac Jan 19 '13 at 20:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.