How can I restrict a ssh user (with only one key) to allow only :

  • a set of commands, with as many arguments as they want
  • tunnelling capabilities (ability to open ports)

I have found some examples based on authorized_keys, or sshd config, but none that really fit my need.

edit: Just to clarify, I don't need the user to be able to ssh into the machine and access to a shell. The user is just supposed to be able to run a given set of commands, such as 'ls' or 'date' for example. I don't want to restrict the user on the parameters. So I want to be able to have a white list, rather than a black list: I need to have a way to describe a set of commands than the user can run, all the others being denied.

Example of commands I want the user to be able to run:

  • ssh remoteserver date
  • ssh remoteserver 'ls -la'
  • ssh -R 1234:localhost:5678 remoteserver
  • 1
    Put the user in chroot and add only "commands" (binaries), that you want to allow to run. – Jakuje Jun 28 '16 at 12:00
  • @Jakuje Can I put the user in a chroot if he doesn't have a shell ? (see the edit) – TimPoe Jun 28 '16 at 15:15
  • No. The users run the commands from the shell. Even if you specify the command on the command-line as an argument to ssh. – Jakuje Jun 28 '16 at 16:42
  • @Jakuje ok, so how would I do that ? Note that I want a whitelist of available commands, not a blacklist, and I still want the user to create tunnels – TimPoe Jun 29 '16 at 8:49

There are lots of different ways that you could achieve this. I'm going to list one of several possible solutions.

I would propose using several different layers of protection to prevent users from running the commands that they shouldn't be allowed to access. All of the directions here assume that users have their own /home/[username] directory, that their shell is /bin/bash and you would like them to be use the bash shell when they log in to the system.

1) Change directory permissions so that only the user can edit the contents of their home directory

chmod 755 /home/[username]

2) Remove the user's .bashrc file

rm /home/[username]/.bashrc This site has more information as to why it might be a good idea to delete the .bashrc in this situation.

3) Create a .bash_profile and add "safe" aliases for all the commands that you would like to disable

./bash_profile file example

alias apt-get="printf ''"  
alias aptitude="printf ''"  
alias vi="vi -Z" #this is vi's safe mode and shell commands won't be run from within vi
alias alias="printf ''"  

And please check the full list of bash commands for more information. You must make sure that the alias alias="printf ''" command is the last command on the list otherwise you lose your ability to alias all of those commands.

4) Disable shell commands in vi by aliasing the vi command to restricted mode
The syntax is alias vi="vi -Z", but please see this site for more information.

5) Change the ownership of the user's .bash_profile to root
chown root:root /home/[username]/.bash_profile

6) Remove write permissions on the user's .bash_profile
chmod 755 /home/[username/.bash_profile]

7) Finally change the users bash to restricted bash mode so that they can't change directories (if you don't have a restricted bash mode on your system, this link will help and give you more information)
chsh -s /bin/rbash [username]

Now when the users log in they won't be able to change directories, all of the commands that you don't want them to use will output the same information as if the user pressed the ENTER key with no command specified, and your /bin/bash functions stay intact.

Depending on what functions you choose to or not to alias this way, users may still be able to circumvent some of the controls that you implemented. However, since we implemented a few safety buffers, the user would really have to know about computer systems to do anything dangerous.

On a related note and something that you might want to consider, if you directly place these aliases into each and every users' .bash_profile you would have difficulty maintaining which functions should and shouldn't be aliased, and if you need to change the alias on anything you would have to change all of them individually. Also, since users can use vim or vi to view files, they could see the contents of their .bash_profile and understand what restrictions they have and don't have.

To get around this I would suggest.

1) Putting all of the aliases in a directory not accessible by the users (paste the contents of the .bash_profile here)


2) Sourcing the aliases into their .bash_profile

improved ./bash_profile file example

if [[ -f /[path_to_file]/startup_functions_for_beginners.sh ]]; then
    . /[path_to_file]/startup_functions_for_beginners.sh

This should put you on your way, but remember that there are almost always ways to circumvent restrictions.

Also, feel free to remix the information in this answer to suit your needs. These can most definitely be combined with a number of other restrictions as well.

Q: I need users to have access to fg and bg, but I don't want them to be able to access aptitude or bash

alias apt-get="printf ''"  #the user won't be able to run this  
alias aptitude="printf ''"  #the user won't be able to run this  
alias bash="printf ''"  #the user won't be able to run this  
#alias fg="printf ''" #this will run as a bash built-in  
#alias bg="printf ''" #you actually don't need to include these in your script  
  • Thank you for this lengthy answer. I have a feeling that you're adressing a bigger problem than mine (and in this case, sorry for not explaining properly) : I don't need the user to be able to access to a bash, I just need it to be able to execute a given list of commands. I have edited my original post to reflect this. Please confirm that your answer remains valid, and that there is not a simpler alternative (as it seems quite long to apply your answer). – TimPoe Jun 28 '16 at 15:04
  • I think, after reading the updated question, my solution would not properly apply to you. It is more concerned about security and preventing users from accessing things. And I am sorry, I couldn't think of anything now to apply to your situation. – Michael D Jun 28 '16 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.