3

I need to confine remotely logged in users to stay in 1 directory only, so I would thought I should attack this problem via SFTP or SSH, so I asked in

Restrict sftp user to a single directory in El Capitan.

But since sshd_config requires each component in the directory path must be owned by root, this requirement is not even possible in our case. So I guess both SSH and SFTP are not the solution.

What other approach can I take to do this task?

PS: After further reading, I think /bin/bash -r might be the way forward. Not sure if I can set up ssh to load /sh/bash -r by default.

PS: Tried to specify /bin/bash -r in Login Shell field within the user's Advanced Options in Users & Groups. Now the user cannot even login; password prompt keeps returning. In system.log, I get

PAM: authentication error for illegal user

Removing the -r option then the user can log in. I think a bit more config in sshd_config or /etc/pam.d/sshd will do the job....

Improve this question
7
  • You can try to add /bin/rbash as a shell for a user. It might help, since the previous one might got parsed wrong. But I don't think that sftp would work under these settings (maybe internal-sftp?), but for ssh it might be a partial solution. And by the way, to understand the importance of requirements "root owned", you should check CVE-2009-2904
    – Jakuje
    Jan 17, 2016 at 9:20
  • In OS X there's no rbash shell.... When I looked up man page for bash, it says to use -r for restricted. Ummm... May be I can alias "/bin/bash -r" and trigger it instead?
    – charleslcso
    Jan 17, 2016 at 9:32
  • Yes. It is worth trying.
    – Jakuje
    Jan 17, 2016 at 9:33
  • Tried it. I got: /rbash.sh Exec format error Gotta give up.
    – charleslcso
    Jan 18, 2016 at 2:03
  • Please, post exactly what you put into the file and to the user.
    – Jakuje
    Jan 18, 2016 at 7:02

1 Answer 1

Reset to default
3

Create a file /bin/rbash, make it executable and and set it as a shell for this newly created user:

#!/bin/bash
exec /bin/bash -r "$@"

The user over ssh is limited as manual page for bash describes in "RESTRICTED SHELL" section.

Improve this answer
5
  • Most importantly, "exit"'ing after logging into the restricted bash won't jump to a non-restricted bash! It disconnects completely! Yeah!
    – charleslcso
    Jan 18, 2016 at 9:43
  • I tried it without the exit in the third line.
    – charleslcso
    Jan 18, 2016 at 9:50
  • The third line should never get executed, since the bash -r get exec-ed. Or what did you mean by your first comment?
    – Jakuje
    Jan 18, 2016 at 9:53
  • I have no knowledge of how OS X loads /rbash.... I thought, may be OSX loads the proper /bin/bash first then load /rbash. If so, even tho I have a restricted bash at the end, typing "exit" might bring me back to /bin/bash, which makes this whole exercise pointless. However I was proven wrong; OSX loads /rbash directly!
    – charleslcso
    Jan 18, 2016 at 9:58
  • 1
    *nix way is as you wrote, but using exec, the original bash is "replaced" by rbash and there is no way to "return" back to the non-restricted bash.
    – Jakuje
    Jan 18, 2016 at 10:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .