up vote 1 down vote favorite
share [g+] share [fb]

I have an embeded linux video server that I just finished. One of the features is that I have a telnet server as well as getty bound to an rs232 port which a user can log into to call a few programs which I have written for server configuration purposes. This is intended to be a backdoor for users if for some reason, the SDK I developed isn't working or they just bought the server and don't have a programmer to put the SDK to use. There is also a web interface, but whatever, the spec says I have to have one.

So for instance, I wrote a program called getIp which allows a user to retrieve network settings and setIp which allows them to set the IP. I have a similar program or script for every function that my .NET based API already does.

However, I do not want them to be able to run any programs other than these. i.e. I don't even want 'ls' or 'cd' to work. I would give them a user name, say "admin", to login to the session with. The question is, how do I setup these restrictions?

link|improve this question
89% accept rate
feedback

1 Answer

up vote 3 down vote accepted

Write a program that only gives users the options you wish them to have. Make that program the shell for the users they login as.

link|improve this answer
#1 I don't know how to do the shell part. Could you tell me how? #2. Could I just limit the path env variable to only include a folder with those programs in it? – Jonathan Henson Oct 27 '11 at 2:26
To make the program their shell, just edit /etc/passwd so that their shell (the last parameter) is the full path to that program. – David Schwartz Oct 27 '11 at 4:35
thanks, when I looked at the file, it all started making sense. – Jonathan Henson Oct 27 '11 at 16:16
Out of curiosity, would #2 work? – Jonathan Henson Oct 27 '11 at 18:15
@JonathanHenson: No, because you can run programs outside your path by specifying the full path to those programs. – David Schwartz Oct 27 '11 at 21:17
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.