You need to change User2's account so that it uses a restricted shell such as rbash
.
sudo chsh -s /bin/rbash User2
NOTE: this will only restrict the user's command-line shell (including logging in via ssh
). It will not affect their GUI desktop environment e.g. if they log in on the console.
See man rbash
for more details but some of the restrictions are that the user is prevented from:
· changing directories with cd
· setting or unsetting the values of SHELL, PATH, ENV, or BASH_ENV
· specifying command names containing /
· specifying a filename containing a / as an argument to the . builtin command
· redirecting output using the >, >|, <>, >&, &>, and >> redirection operators
· using the exec builtin command to replace the shell with another command
These restrictions are enforced after any startup files are read.
Blocking redirection may be excessive for your needs (or maybe not since the directory is readonly anyway), but unfortunately with rbash
it's all or nothing.