1

As it is a part of the job on every Linux System Administrator to login in a lot of production servers which mean that it easily something can go wrong and to broke a production machine. There are a lot of cases when someone is tired or get a call over the night and can do "rm -rf test" instead of "rm -rf test.1" for example. So there are a lot of ways to predict something like that and block some commands on user level or kernel, but with root access will not be a good practice. Also when you connect to a lot of machines ( 100-200 ) it is hard task to configure to forget some commands on all of them.

So I am looking for some way how you can easily and safely this can be achieved. It should be working only when you are login via ssh and sometimes to be removed. So I think something like custom command in the preferences in the terminal/terminator/ssh agent/or some other tool for command line. I am not sure if it is possible, but I think that it will be useful for a lot of people.

2

It is possible to limit command execution via ssh, but this will not be in place if you permit a login shell.

One way to do this is via the authorized_keys file and putting command="/bin/foo/bar" at the front of the key line.

Another, more secure way is to use sudo and specify there what you want to allow a user to elevate to and execute. If you often have issues with users removing test, and not test.1 then this is the correct place to keep that safety net.

If your admins have regular actions, perhaps thing of encapsulating the operations in /usr/local/bin scripts so that if they want to tidy disk space, then this script could go through the normal housekeeping tasks, perhaps ship logs to a central location or just compress some to dated archives. Might save some time fixing problems later!

1

You should consider putting a warring or support line using SSH banner. Yet you could disable the ability to switch user's using the command 'su':

sudo chmod u-s /bin/su

then, only sudo group will be able to do it.

Also, everything in the directory /etc/skel/ will be copied to each new created user, add some aliases and reminders there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.