Firstly, permissions. When you create a new account (with
adduser on Debian-based systems, anyway - others might be slightly different), you get a new user and a new group with the same name. You also get a home directory for the user. This new user will have user and group read/write permissions on their home directory. They will also be able to access anything designated as world-readable, and modify anything that's world-writeable.
As far as I know, it is not possible to specifically exclude one user or group from world-read/write permissions using the traditional POSIX permission system. You can however, enable the more advanced ACLs (much like Windows' NTFS, if you're familiar with that), which allow you to set specific deny permissions.
An alternative method is to set up a custom login shell, using the
chsh command or by modifying
/etc/passwd. When they log in, this 'shell' will be executed with the user's input redirected as its standard input, and its standard output/error redirected to the terminal output. You can set this 'shell' to be any executable on the system, including (but not limited to) your own C program, bash/python/perl script, etc..
There are a few ways you could do this. You could set the login shell to be a script that simply outputs whatever data you want, and takes no input. It just outputs the data and exits, closing the SSH session. This is the most secure way, though not as flexible.
Alternatively, you could have a script take some input, and use that input to determine what to print. How you do this is up to you - if you use a
bash script, you can use
read along with a
case statement or a series of
if statements. You do have to be careful that you don't run any unsanitised commands from the user directly, though - and there are other possible security issues with taking untrusted input. For example, you might take the input
processes and return the output of
If you want, and are good with C, you could even modify
bash itself to not be able to access any other directories - but it's far more secure to either not take input or to filter only specific whitelisted commands, rather than trying to restrict which directories you can access. It's also easier to write a quick shell script than to modify a complex C program.