I would like to create an SSH account on my Mac to allow some friends to test code on my machine from the command line.

However, I want to sandbox them, so that the only folders/files they can see are those owned by them within their user folder. All other user folders, the application folder, etc, would be hidden. Ideally external volumes would also be hidden.

Is this possible to do with a standard user account? (The other accounts on the system are admin accounts) Is the guest account a better choice?

  • Does it have to be a macOS environment? If a linux environment is OK, I would recommend using VM / Docker. – amdyes Dec 5 '18 at 2:44
  • Yes, has to be a Mac. – Kirkman14 Dec 5 '18 at 4:05

Secure Shell (ssh) Jail

The phrase you need to search for is jail ssh user.

See the questions and articles linked below for a range of approaches; being Unix-y, these approaches should also work on macOS:

  • Would creating a jail like this would prevent the user from having access to standard tools in /usr/bin or /usr/local/bin such as gcc, ld, make, etc? – Kirkman14 Dec 6 '18 at 0:37
  • According to the links, yes you can control which binaries the user has access to. Pick one of the approaches in the links, start working through it, and feel free to ask new questions as problems arise. – Graham Miln Dec 6 '18 at 7:38
  • This seems like the right approach, and it seems like it should work under the Mac. Despite following multiple tutorials, though, I can not get jailkit or the jail technique to work on my Mac. – Kirkman14 Dec 11 '18 at 16:54
  • Feel free to ask more specific questions saying what you have done and which bits are troublesome. Detailed more specific questions tend to attract answers. – Graham Miln Dec 11 '18 at 18:47
  • 1
    Agreed. At this point I'm just waiting to see if anyone might propose any other solutions to my original sandbox question besides the jail technique. – Kirkman14 Dec 12 '18 at 4:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .