Utility to create restricted shell account using Bash in rbash mode.
GNU project's Bash running in
rbash mode is a viable choice if you
are trying to somewhat contain trusted users. This project includes
basic files and utility to create a dummy user that only can run
commands of your choice. Useful for setting up tightly confined secure
accounts that allow minimum access to restricted set of commands.
Project homepage (bugs and source) is at <http://freecode.com/projects/restricted-shell-rbash>.
How does it work?
Bash installation contains
rbash binary which restricts access.
What is left to do is to provide a small set of configuration files to
go with the account. The concept is pretty straight forward but it is
tedious to type all the commands. This project automates the steps to:
- Create a user account, provided it does not exist. Set login shell to
- Copy minimal startup files (Bash, SSH).
- Symlink allowed commands to user's
bin/directory and point PATH there.
- Set tight permissions for the account directory and its files.
After these steps, the account is hopefully sufficiently locked down.
User cannot edit configuration files, change PATH, run commands
starting with slash, or cd anywhere, so the only commands available to
him are those in
- Environment: Linux only
- Build: Perl and standard GNU make
- Run: Bash for
/bin/shand GNU command line programs, e2fsprogs package for
/usr/bin/chattrand optionally util-linux package for
Login to the server that distributes
/home directories, switch to
administrator root, select a login name (or supply existing login),
which will be locked. Use Option --test to see what would happen
./makefile.sh -v --init --force --test dummy date ls ssh | | | List of allowed commands User's login name -f, --force Allow destructive changes, like overwriting files in user's account. Used prmarily when command is repeated so that new set of commands can be defined freely. -i, --init Clean initialization. Delete all previous commands from user's bin/ directory before creating symlinks to the allowed commands. -v, --verbose Display verbose messages.
After the initialization, you might want to check how the account works:
# set password passwd dummy Enter new UNIX password: xxx Retype new UNIX password: xxx # Test restricted shell by logging to an account. It's not possible # to use su(1) here. See manual page of restricted-shell-create(5) # why su(1) does not work. login dummy password: xxxxxx # See what you can do as user dummy? $ ls $ date $ perl -V -rbash: perl: command not found
MENU BASED SHELL
A popular Perl based menu shell is available at <http://freecode.com/projects/pshell> which also may interest you.
The implementation presented here does not require Perl and additional
modules, just plain POSIX shell
bin/ contains a very simple menu script that allows
running only defined set of commands. You could use it instead of
rbash approach by setting user's shell to the script.
This script is experimental and provided "as is". Use your judgement
if you want to use this approach
# Create user "dummy" ./makefile.sh dummy # Install command menu based "restricted shell" install -D -m 700 bin/rshell.sh ~dummy/bin/rshell # Edit commands in case-statement of Main() function $EDITOR ~dummy/bin/rshell
COPYRIGHT AND LICENSE
Copyright (C) 2011-2013 Jari Aalto <firstname.lastname@example.org>
This project is free; you can redistribute and/or modify it under the terms of GNU General Public license either version 2 of the License, or (at your option) any later version.