restrict commands to users

tambi101 · 06-23-2015, 08:58 AM

i have a user (john) in server user(john) should not execute any commands (except ssh,exit) can we do this with out scripting ! what is the best way to do this

regards
kiran

pan64 · 06-23-2015, 09:01 AM

probably you can configure restricted login shell for him, but actually you ought to specify better your requirements.

fatmac · 06-23-2015, 12:50 PM

Use sudo, (see man sudo).
http://www.sudo.ws/

Keith Hedger · 06-23-2015, 01:47 PM

Quote:

Originally Posted by fatmac

Use sudo, (see man sudo).
http://www.sudo.ws/

Surely confining what commands can be run with sudo only works if the user prefixes all his commands with 'sudo' or am I mistaken - wouldn't be the first time

Keith Hedger · 06-23-2015, 01:50 PM

I guess you could set the users PATH to a folder that only has symlinks to ssh ( isn't exit a bash builtin? ), not too sure how you would stop the user from altering the PATH variable though.

chrism01 · 06-25-2015, 06:28 AM

Try a chroot acct ?
Or, build a small menu that only allows those cmds. As above, really need more details

tambi101 · 06-25-2015, 09:16 AM

Quote:

Originally Posted by fatmac

Use sudo, (see man sudo).
http://www.sudo.ws/

as i know sudo is for super user do , we can execute command as another user

---------- Post added 06-25-15 at 07:47 PM ----------

Quote:

Originally Posted by pan64

probably you can configure restricted login shell for him, but actually you ought to specify better your requirements.

thank you for your reply !

tambi101 · 06-25-2015, 09:20 AM

Quote:

Originally Posted by Keith Hedger

Surely confining what commands can be run with sudo only works if the user prefixes all his commands with 'sudo' or am I mistaken - wouldn't be the first time

thanks for reply ! yes you are mistaken again i tried on sudo already , super user do , we can execute command as another user if i was wrong please let me know

Turbocapitalist · 06-25-2015, 10:03 AM

Quote:

Originally Posted by Keith Hedger

I guess you could set the users PATH to a folder that only has symlinks to ssh ( isn't exit a bash builtin? ), not too sure how you would stop the user from altering the PATH variable though.

Hard links there might work too. Alteration the path can be prevented with rbash or rksh as the login shell for that user. Just also make sure that the home directory and the files in it are not in anyway writable ( or owned by ) the user in question.

fatmac · 06-25-2015, 02:41 PM

Quote:

Originally Posted by Keith Hedger

Surely confining what commands can be run with sudo only works if the user prefixes all his commands with 'sudo' or am I mistaken - wouldn't be the first time

I was under the impression that the O.P. wants the user John to have root power for ssh & exit. If he is given that power using sudo, they are the only programs that he can run as root.