Restrict SSH commands for a group of users

Question

I'm trying to set up an environment where a number of users in a certain group can SSH into a server and then execute a set of predefined commands on it, using either a key exchange or a password. So far I've been told to look into the authorized_keys "commands" section, but as far as I can tell this is only useful for non-human users.

Is there a way to either blacklist or whitelist a number of commands for a certain user group?

For example, users in group X should be able to ls, /etc/init.d, rm, but nothing else.

score 3 · Accepted Answer · answered Nov 19 '12 at 12:08

You will need to create a restricted command shell in the script language of your choice, then set up sshd to force usage of this restricted shell for the group you specify.

Example 8-1 and other following parts of O'Reilly's SSH, The Secure Shell Chapter 8 show ways to do the former.

For the latter, see the Match directive description in sshd_config(5).

As an example, you could add the following to /etc/ssh/sshd_config:

Match Group X
ForceCommand /path/to/your/restricted_shell

score 1 · Answer 2 · answered Nov 19 '12 at 11:41

1

I think that the proper way to do that is to combine chroot(controlled/limited environment) with ssh

You may want to have a look to this guide http://www.techrepublic.com/blog/opensource/chroot-users-with-openssh-an-easier-way-to-confine-users-to-their-home-directories/229

answered Nov 19 '12 at 11:41

Nikolaidis Fotis

2,032
11
13

I'm not much concerned about which folders these user can go to, but instead I would like them to only use a set of commands. For example, they should be able to change the passwords of users that aren't in that certain group (and not root's, obviously), and they should be able to restart certain processes. So if I find a way to restrict their shell usage to commands such as `passwd` and `killall` that would be sufficient, because I would just remove `cd` and `ls` from that list. – doque Nov 19 '12 at 12:07
downvoted as the link is dead. That's why link only answers are not preferred. – Varun Chandak Jul 04 '18 at 04:05
1

awesome ! you revived a six-years old post to downvote it ?! The answers lies in chroot (in bold) and ssh. The link is just the first link returned by google (which btw works perfectly fine). It's additional material and does not consist part of the answer – Nikolaidis Fotis Jul 15 '18 at 13:44

score 1 · Answer 3 · answered Nov 19 '12 at 14:28

not sure it's suitable with your environment or not, i use this on my env. the idea is use restricted bash, clean up $PATH, protect $PATH and set $PATH to $HOME/bin, and then you just symlink all binary that you allowed to run by user to $HOME/bin.

 -------------------------------------------
#!/bin/bash

USERS="user"

PASS=secret
ALLOWED_CMDS="/bin/ping
/usr/bin/killall
/bin/ps
"

# creating restricted bash
ln -s /bin/bash /bin/rbash

for user in ${USERS}; do
        home=/home/${user}
        echo useradd --comment \"CDM user with restricted shell\" --home-dir ${home} --shell /bin/rbash ${user}
        useradd --comment "CDM user with restricted shell" --home-dir ${home} --shell /bin/rbash ${user}
        echo "set password for ${user}"
        echo ${PASS} | passwd ${user} --stdin
        if [ -d ${home} ]; then
                # deleting unneeded files
                files=".bashrc .bash_history .bash_logout .bash_profile  .emacs  .mozilla"
                for file in ${files}; do
                     rm -rfv ${home}/${file}
                done

               # creating bin dir and profile
                echo "export PATH=\$HOME/bin"> /home/$user/.profile
                echo "export PS1=\"[\u@\h \W]$ \"">> /home/$user/.profile

                mkdir ${home}/bin
                chmod -R 755 ${home}
                chown -R root:root ${home}
                chmod 750 ${home}/.profile
                chown root:${user} ${home}/.profile

                chmod 2070 /home/$user
                chown root:$user /home/$user

                # allowed specific commands only
                echo "creating symlinks for allowed commands.."
                for cmd in ${ALLOWED_CMDS}; do
                    ln -sv ${cmd} ${home}/bin/
                done
        fi
done
 -------------------------------------------

 [root@puppet tmp]# sh create_user.sh
 [root@puppet tmp]# su -l user
 [user@puppet ~]$ ping
 Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]
 [user@puppet ~]$ ls
 -rbash: ls: command not found
 [user@puppet ~]$ cd
 -rbash: cd: restricted
 [user@puppet ~]$ pwd
 /home/user
 [user@puppet ~]$ ps
 PID TTY          TIME CMD
 9605 pts/1    00:00:00 rbash
 9629 pts/1    00:00:00 ps
 [user@puppet ~]$ killall
 Usage: killall [-Z CONTEXT] [-u USER] [ -eIgiqrvw ] [ -SIGNAL ] NAME...
 [user@puppet ~]$ nc
 -rbash: nc: command not found
 [user@puppet ~]$ nmap
 -rbash: nmap: command not found

Restrict SSH commands for a group of users

3 Answers3