7

I'm trying to make a user that can access my server through SSH and allow it to have a shell, limited to using only, say screen and irssi. And it shouldn't it be able to see other directories except it's home folder and sub directories within it. And the usage of memory/cpu should be limited to a certain amount. How should I go about implementing it on a Centos 6.1 server?

3
  • 1
    Virtualization is the way to go; chroot only provides very limited security (no restriction on network, CPU or memory usage). I don't know what virtualization options are available out-of-the-box on CentOS . Dec 17, 2011 at 22:25
  • For limiting memory / cpu usage, maybe look into PAM limits settings. Also, screen can contain any shell and run any command, so are you saying you only want the user to be able to run a persistent irssi instance?
    – jw013
    Dec 21, 2011 at 2:32
  • @jw013 not exactly, I just want to restrict the user to use only the commands I provide, the example of screen and irssi - so that they couldn't self compile programs and such, and that they don't over use the resources of the computer.
    – Maverick
    Dec 23, 2011 at 11:36

2 Answers 2

7

Use use the "command" directive from the ssh authorized_keys file, and/or specify that a restricted shell (/bin/rsh) should be used for the user. The o'reilly ssh book is a key reference guide (no pun intended); or google for "restricted shell", "ssh authorization file". Some references:

  • an example or two showing how invoke a custom command (or script) when you ssh into a box
  • an example showing a whole set of recommendations for restricting access
  • another s.o. example for a very similar question (the orig question is suspect, but a lot of good answers)

Anyway, this is sort of a meta-answer pointing to other answers, but the key really is using the authorization file and specifying the command(s) that are allowed to be executed on the remote host, and/or using the restricted shell to limit access to the remote box.

1
  • 1
    thank you for the links. that should keep me busy for awhile. :)
    – Maverick
    Feb 11, 2012 at 15:58
0

First of all check please ChrootUser in /etc/ssh/sshd_config it should jail Your users (there is specific version of OpenSSH needed for that).

Second method is to install some jail software. I'm using jailkit on some servers and it's giving me all what I need.

Third possibility is probably grsec if it's still in development. :-)

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .