0

I have set restricted user with limited commands to run with .profile and PATH variable but user can set his path using:

$ export PATH=$PATH:/bin:/sbin:/usr/bin

and can get access to other commands.

Is there anyway to restrict user from setting his path?

2
  • use a proper solution such as apparmor selinux simple user account without to much right, but please try to use the correct tool to the correct problem. As soon as a user is able to login with interactive shell or gui he can do whatever he wants with his env. hidding path to binary is also the worst way to protect yourself from anything
    – Kiwy
    Commented Apr 26, 2018 at 7:54
  • You should restrict the path they can read. Restricting PATH is not a good solution: one could explicitly add the full path in front to the commands. chroot could also be usefull. Commented Apr 26, 2018 at 12:35

3 Answers 3

4

You can use the readonly Bash built-in to make a variable, well, read only. But this is unlikely to deter someone bent on changing their environment, as they could simply start a new shell without running the RC files and set up their own environment. Also, this does not in any way hinder someone from running programs not in the PATH. The PATH variable is simply a convenience feature, to allow users to write foo rather than for example /usr/bin/foo. That's it. It's not related to security in any way.


The key to securing an environment is to first take a long hard look at what your threat model is - do you expect users to try to read other users' files, to break the installation, to eavesdrop on communications, to send spam, to get root access, or something else? Once you've established this you can start working out which measures will actually achieve this.

3
  • thats irony, I can add user in other group than root but then ssh can not login. It has to have ssh login and I can set up other group for that user
    – coder007
    Commented Apr 26, 2018 at 3:31
  • What do you mean? Users not in the "root" group can't log in via SSH? If so that's a weird setup.
    – l0b0
    Commented Apr 26, 2018 at 3:40
  • Initially there is only root user and group but for this restricted user, I can add new group if needed for permission denial for other commands but ssh also has root only group. I have to find way without changing much.
    – coder007
    Commented Apr 26, 2018 at 4:00
4

You should look into bash "restricted" mode (started with bash --restricted or bash -r), which prevents commands such as cd and blocks running any executable by the full path, so it only allows executing what is in $PATH.

Also, it prevents modifying environment variables such as PATH.

You can find an overview of bash "restricted" mode here.

3
  • unfortunately, my shell is ash and not full featured bash. so only options are: Usage: ash [-/+OPTIONS] [-/+o OPT]... [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS]]
    – coder007
    Commented Apr 26, 2018 at 3:56
  • You can always install bash... Anyways, you mentioned "restricted user with limited commands" and bash -r fits that description... I don't know what else you think might be restricted. As @l0b0 pointed out, $PATH is just a shortcut, they can access other binaries by using their full path anyways... bash -r blocks that too.
    – filbranden
    Commented Apr 26, 2018 at 4:01
  • I installed bash and set bash -r shell but problem is I can not ssh login with it but if I just use bash then I can login. At this point user still in same group as root but in same situation ash can login.
    – coder007
    Commented Apr 26, 2018 at 5:50
1

Finally, get it working so bash -r did not work but I found rbash binary installed which is restricted version of bash.

After adding /bin/rbash as a shell for restricted user, it can not set path or execute with complete path and thats what I wanted. Thanks for help everyone!

5
  • 3
    Be aware that rbash does not disable Ctrl/C while running the user's login scripts, so it's perfectly possible to break out during the login process. This allows the user to run programs in the standard PATH before it's been locked down or changed. Typically other shells are in that PATH and it's then trivial to escape. Commented Apr 26, 2018 at 6:54
  • Very nice, @coder007, I'm glad this helped you find what you were looking for!
    – filbranden
    Commented Apr 26, 2018 at 7:18
  • @roaima I got to know about that hack to break into rbash login but if login scripts are read and execute only, it should fix this hack ??
    – coder007
    Commented May 11, 2018 at 2:36
  • @coder007 unfortunately no. Commented May 11, 2018 at 6:14
  • 1
    Please note that rbash is not really a secure environment for interactive sessions, as there are many ways to escape into a non-restricted shell, e.g. awk 'BEGIN{system("/bin/sh");}' Commented May 11, 2018 at 7:03

Not the answer you're looking for? Browse other questions tagged .