-1

On a linux-pc we have two user-accounts - the first is also the root-user and the second is only a normal-user. How can we make so that the second user will be unable to open the terminal?

  • You can't. Technically a process of that user can always find a way to open a terminal. – 炸鱼薯条德里克 Aug 4 at 14:13
  • 2
    This is X-Y and too board. You want to prevent careless operation to damage your computer, but prevention of command line interface is not a solution. – 炸鱼薯条德里克 Aug 4 at 14:18
  • 2
    To follow on to the comment about the XY problem -- if you tell us why you are trying to do this, maybe we can help you find the appropriate solution for your problem. – user4443 Aug 5 at 4:46
1

Set their shell to /bin/false with chsh. e.g. (as root):

chsh -s /bin/false username

This will prevent them from getting a shell when logging in at the console or via ssh etc. This is good enough for most purposes, but if they can run other programs on the system, there are many other ways for them to get a shell.

This will also effectively prevent them from logging in at all, so unless it's a system user meant to run a particular daemon (e.g. www-data to run apache) or it's mailbox-only user or similar, there's not much point in the user having an account at all.


Another, probably better, option is to set their shell to a restricted shell such as /bin/rbash, which only allows them to run programs in their (pre-set) PATH, and prevents them from changing directory with cd or changing environment variables like SHELL, PATH, etc. See man rbash for details.

e.g. you could create a directory somewhere on the system (e.g. /usr/local/rbin), copy or link the allowed binaries into that, and set their PATH so that they can only run programs found in that directory. You need to be careful what programs you put in this directory - e.g. install rvim rather than vim if they need a text editor (rvim doesn't allow executing shell commands).

NOTE: This will be a lot of work and requires careful research to get it right (i.e. to avoid leaving some loophole that allows shell access). There are several questions and answers about rbash and other restricted shells here on this site. Start your research with:

https://unix.stackexchange.com/search?q=rbash

and the very closely related topic of chroot:

https://unix.stackexchange.com/search?q=chroot

  • I can't see any value in the first part of your answer that couldn't be satisfied by disabling the user account, which presumably the OP doesn't want to do. Have I missed something? – roaima Aug 5 at 8:10
  • 1
    an account with /bin/false or similar as the shell is not the same as a disabled account. they're not completely pointless or useless, either I even included two examples of uses for them ("mailbox-only" accounts, for example, are pretty common on mail servers). – cas Aug 5 at 9:32
  • Mailbox-only accounts I can understand. But what's the relevance of that to the OP's "normal user" account? – roaima Aug 5 at 23:55
  • "normal user" is a term with context-dependent definition. There are environments where "normal users" don't get shell accounts (ISPs, for example)....only very unusual users (like sysadmin or programming staff) get shell accounts. Similar for file-servers, it's not at all uncommon for "normal users" to have non-shell accounts so they can access their own and their groups' files. – cas Aug 6 at 1:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.