On a linux-pc we have two user-accounts - the first is also the root-user and the second is only a normal-user. How can we make so that the second user will be unable to open the terminal?
Set their shell to
chsh. e.g. (as root):
chsh -s /bin/false username
This will prevent them from getting a shell when logging in at the console or via ssh etc. This is good enough for most purposes, but if they can run other programs on the system, there are many other ways for them to get a shell.
This will also effectively prevent them from logging in at all, so unless it's a system user meant to run a particular daemon (e.g. www-data to run apache) or it's mailbox-only user or similar, there's not much point in the user having an account at all.
Another, probably better, option is to set their shell to a restricted shell such as
/bin/rbash, which only allows them to run programs in their (pre-set) PATH, and prevents them from changing directory with
cd or changing environment variables like
PATH, etc. See
man rbash for details.
e.g. you could create a directory somewhere on the system (e.g. /usr/local/rbin), copy or link the allowed binaries into that, and set their PATH so that they can only run programs found in that directory. You need to be careful what programs you put in this directory - e.g. install
rvim rather than
vim if they need a text editor (rvim doesn't allow executing shell commands).
NOTE: This will be a lot of work and requires careful research to get it right (i.e. to avoid leaving some loophole that allows shell access). There are several questions and answers about
rbash and other restricted shells here on this site. Start your research with:
and the very closely related topic of