Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I'm needing to work out a way of restricting a user (ssh login on ubuntu 10.04) to only be allowed to do the following:

  • Upload txt files only (through SCP or SFTP)
  • Execute the php command "php somefile.php"

Is this feasible?

share|improve this question
Can somefile.php be different files or it it really fixed as somefile.php ? – Iain♦ Mar 22 '11 at 8:45
@lain - That depends. If I can limit SCP uploads to only txt files, then restricting the php command to only certain scripts isn't as important. What I'm trying to stop is uploading and then executing a php file – Emmanuel Mar 22 '11 at 9:12

2 Answers

up vote 1 down vote accepted

You could change the users shell (in /etc/passwd) to a custom shell...

Simple example:

#!/bin/bash
php somefile.php    # You might need to give the full path to the php-bin.
bash -r -c read

Save it in /bin, add it to /etc/shells and make it runnable. The user can still use SCP and SFTP, but when he tries to open a shell, the php will run. If he enters, the shell will close.

share|improve this answer
How does this actually effect a certain user? I'm fairly new with these things. I only want to limit a certainuser. Do I need to add your script to the /etc/passwd file? But won't that then effect all users? – Emmanuel Mar 22 '11 at 9:17
In the /etc/passwd you have some options for every user. One of them is their shell, you would need to change it for the user you want to. You would save this in /bin/myawesomeshell. Or if you want to do it via a command, you could use usermod ex: usermod -s /bin/myawesomeshell myuser – Bart De Vos Mar 22 '11 at 9:32
@TiZon - so for example I have this someuser:x:5002:5002::/home/someuser:/bin/sh and the /bin/sh is the shell, right? And I change that to mysawsomeshell ? Oh, perhaps usermod would be easiser – Emmanuel Mar 22 '11 at 9:39
Yes, usermod would be easier. /bin/shis indeed the shell. – Bart De Vos Mar 22 '11 at 9:40
@TiZon - Great! It's working wonderfully now. What are the possibilities with shells? I guess I'll ask Google, but this has been a great help. – Emmanuel Mar 22 '11 at 9:46
show 5 more comments
up vote 0 down vote

It would probably be easier to serve the php script over a web server, and offer a text file upload through the same site. That way you can have incredibly fine control over what's allowed and what's not.

share|improve this answer
Yes, that would. But impossible in my situation. – Emmanuel Mar 22 '11 at 8:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.