0

I'm trying to create a restricted shell for a maintenance user. This user should only be allowed to execute a single bash script within his home folder.

The user should not be allowed to execute any other command or even change the folder. This should work for both SSH and for a normal terminal login directly on the system.

I'm trying to set up this on a Fedora AtomicHost OS. IMHO the best way to do this is by using chroot. But I'm running into some issues, because /bin/su is not working within the chroot environment.

Is there any alternative to chroot?

  • 2
    Couldn't you just set the script as the login shell for the user? That would execute the script upon logging in, and the user would be logged out when the script exits. – Kusalananda Aug 30 '18 at 8:42
  • @Kusalananda Or even better - set as shell some wrapping script that hold the stdout for user until any key will be pressed. – Kondybas Aug 30 '18 at 8:50
  • @Kondybas Something like that maybe, yes. There's no real point in handing the user a shell prompt if the only thing they're allowed to do is to run a single script. – Kusalananda Aug 30 '18 at 8:51
  • At least for debug purposes because script set as shell will be executed in the specific environment. – Kondybas Aug 30 '18 at 8:53
0

You can set the Bash script as the user's shell:

chsh -s /path/to/script.sh -u maintenanceuser

Just double-check that the user won't be able to exit the script and gain access to a shell.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.