Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up an environment where a number of users in a certain group can SSH into a server and then execute a set of predefined commands on it, using either a key exchange or a password. So far I've been told to look into the authorized_keys "commands" section, but as far as I can tell this is only useful for non-human users.

Is there a way to either blacklist or whitelist a number of commands for a certain user group?

For example, users in group X should be able to ls, /etc/init.d, rm, but nothing else.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

You will need to create a restricted command shell in the script language of your choice, then set up sshd to force usage of this restricted shell for the group you specify.

Example 8-1 and other following parts of O'Reilly's SSH, The Secure Shell Chapter 8 show ways to do the former.

For the latter, see the Match directive description in sshd_config(5).

As an example, you could add the following to /etc/ssh/sshd_config:

Match Group X
ForceCommand /path/to/your/restricted_shell
share|improve this answer

I think that the proper way to do that is to combine chroot(controlled/limited environment) with ssh

You may want to have a look to this guide http://www.techrepublic.com/blog/opensource/chroot-users-with-openssh-an-easier-way-to-confine-users-to-their-home-directories/229

share|improve this answer
I'm not much concerned about which folders these user can go to, but instead I would like them to only use a set of commands. For example, they should be able to change the passwords of users that aren't in that certain group (and not root's, obviously), and they should be able to restart certain processes. So if I find a way to restrict their shell usage to commands such as passwd and killall that would be sufficient, because I would just remove cd and ls from that list. –  doque Nov 19 '12 at 12:07

not sure it's suitable with your environment or not, i use this on my env. the idea is use restricted bash, clean up $PATH, protect $PATH and set $PATH to $HOME/bin, and then you just symlink all binary that you allowed to run by user to $HOME/bin.




# creating restricted bash
ln -s /bin/bash /bin/rbash

for user in ${USERS}; do
        echo useradd --comment \"CDM user with restricted shell\" --home-dir ${home} --shell /bin/rbash ${user}
        useradd --comment "CDM user with restricted shell" --home-dir ${home} --shell /bin/rbash ${user}
        echo "set password for ${user}"
        echo ${PASS} | passwd ${user} --stdin
        if [ -d ${home} ]; then
                # deleting unneeded files
                files=".bashrc .bash_history .bash_logout .bash_profile  .emacs  .mozilla"
                for file in ${files}; do
                     rm -rfv ${home}/${file}

               # creating bin dir and profile
                echo "export PATH=\$HOME/bin"> /home/$user/.profile
                echo "export PS1=\"[\u@\h \W]$ \"">> /home/$user/.profile

                mkdir ${home}/bin
                chmod -R 755 ${home}
                chown -R root:root ${home}
                chmod 750 ${home}/.profile
                chown root:${user} ${home}/.profile

                chmod 2070 /home/$user
                chown root:$user /home/$user

                # allowed specific commands only
                echo "creating symlinks for allowed commands.."
                for cmd in ${ALLOWED_CMDS}; do
                    ln -sv ${cmd} ${home}/bin/

 [root@puppet tmp]# sh create_user.sh
 [root@puppet tmp]# su -l user
 [user@puppet ~]$ ping
 Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]
 [user@puppet ~]$ ls
 -rbash: ls: command not found
 [user@puppet ~]$ cd
 -rbash: cd: restricted
 [user@puppet ~]$ pwd
 [user@puppet ~]$ ps
 PID TTY          TIME CMD
 9605 pts/1    00:00:00 rbash
 9629 pts/1    00:00:00 ps
 [user@puppet ~]$ killall
 Usage: killall [-Z CONTEXT] [-u USER] [ -eIgiqrvw ] [ -SIGNAL ] NAME...
 [user@puppet ~]$ nc
 -rbash: nc: command not found
 [user@puppet ~]$ nmap
 -rbash: nmap: command not found
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.