I've deployed CentOS-7 login nodes for users, I want restrict them in resources and command level to prevent nasty activities, so far my search only ended up to rbash and lshell and etc..., is there any way to achieve in more generic/globally?

I only want narrow down the command access to one command.


  • This may be more appropriate for Server Fault Aug 11, 2020 at 19:52
  • you might make jails for your users in that case so they can only use the commands authorized inside the jail.
    – francois P
    Aug 12, 2020 at 13:18

1 Answer 1


Resource limits for users are set (via PAM) in /etc/security/limits.conf. More fine-grained control can be had by using SELinux (but easy it isn't). The r shells/commands are a straightjacket, to be used to completely constrain external connections. You could set up chroot environments, or even custom virtual machines/containers.

But then again, consider carefully what you are doing. It is OK to restrict effects of possible accidents (fork bomb, anyone?), it is quite another to curtail legitimate actions. Users under fascist system administration will get mad, and will find a way to get even. There are usually many more users than sysadmins, by sheer numbers they'll get the upper hand. The good will of your users is precious, don't squander it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .