2

I need to confine remotely logged in users to stay in 1 directory only, so I would thought I should attack this problem via SFTP or SSH, so I asked in

Restrict sftp user to a single directory in El Capitan.

But since sshd_config requires each component in the directory path must be owned by root, this requirement is not even possible in our case. So I guess both SSH and SFTP are not the solution.

What other approach can I take to do this task?

PS: After further reading, I think /bin/bash -r might be the way forward. Not sure if I can set up ssh to load /sh/bash -r by default.

PS: Tried to specify /bin/bash -r in Login Shell field within the user's Advanced Options in Users & Groups. Now the user cannot even login; password prompt keeps returning. In system.log, I get

PAM: authentication error for illegal user

Removing the -r option then the user can log in. I think a bit more config in sshd_config or /etc/pam.d/sshd will do the job....

  • You can try to add /bin/rbash as a shell for a user. It might help, since the previous one might got parsed wrong. But I don't think that sftp would work under these settings (maybe internal-sftp?), but for ssh it might be a partial solution. And by the way, to understand the importance of requirements "root owned", you should check CVE-2009-2904 – Jakuje Jan 17 '16 at 9:20
  • In OS X there's no rbash shell.... When I looked up man page for bash, it says to use -r for restricted. Ummm... May be I can alias "/bin/bash -r" and trigger it instead? – charleslcso Jan 17 '16 at 9:32
  • Yes. It is worth trying. – Jakuje Jan 17 '16 at 9:33
  • Tried it. I got: /rbash.sh Exec format error Gotta give up. – charleslcso Jan 18 '16 at 2:03
  • Please, post exactly what you put into the file and to the user. – Jakuje Jan 18 '16 at 7:02
2

Create a file /bin/rbash, make it executable and and set it as a shell for this newly created user:

#!/bin/bash
exec /bin/bash -r "$@"

The user over ssh is limited as manual page for bash describes in "RESTRICTED SHELL" section.

  • Most importantly, "exit"'ing after logging into the restricted bash won't jump to a non-restricted bash! It disconnects completely! Yeah! – charleslcso Jan 18 '16 at 9:43
  • I tried it without the exit in the third line. – charleslcso Jan 18 '16 at 9:50
  • The third line should never get executed, since the bash -r get exec-ed. Or what did you mean by your first comment? – Jakuje Jan 18 '16 at 9:53
  • I have no knowledge of how OS X loads /rbash.... I thought, may be OSX loads the proper /bin/bash first then load /rbash. If so, even tho I have a restricted bash at the end, typing "exit" might bring me back to /bin/bash, which makes this whole exercise pointless. However I was proven wrong; OSX loads /rbash directly! – charleslcso Jan 18 '16 at 9:58
  • 1
    *nix way is as you wrote, but using exec, the original bash is "replaced" by rbash and there is no way to "return" back to the non-restricted bash. – Jakuje Jan 18 '16 at 10:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .