Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I limit the scope of executable commands a linux user can run?

For example, I only want user to be able to run the ls command and nothing else. If tried, for example to run cat, linux would throw an error or return null.

I've looked into the alias command to set a predefined list of custom commands, but this doesn't limit the user from running other commands. I actually would love to set alias commands then limit the scope to just those.

I've also looked into this documentation on confining users, but still unsure about how to go about it.

Scope: I'm using a service account to run ssh commands within our PHP app. I want to limit the commands for that service account to prevent a situation where someone injects commands into the ssh_exec(); - such as ls and inject | some command

I think I'll try this:

share|improve this question
Can you tell us more about why you think you need to do this? There are several different approaches that may apply here, but you need to give us more context so we can advise you. Or are you just looking for a getting started guide to selinux? – Zoredache Jan 23 '14 at 23:33
See above Scope – George Ortiz Jan 23 '14 at 23:50
up vote 2 down vote accepted

You can also bind commands to specific ssh keys in the authorized keys file.

from="",command="/bin/ls" ssh-dss <SSH PUBLIC KEY>

What this does is restrict access to the account using a certain ssh public to only run a specific command from a specific host. See

man sshd 

for more options.

share|improve this answer

I would probably engage this situation by writing a wrapper script. There is a part solution available here for you to begin with, please read up and see if you can't make it from this link.

I know this specifies the use of UID, if you need this for several users, think in terms of using GID instead and putting all these kinds of users in that very same group.

Cheers and good luck!

share|improve this answer

If you want to limit command executions of SSH users, you can use ChrootDirectory introduced in OpenSSH 4.9p1

You will also find a statically-linked binary of busybox useful in setting up a chroot environment. (The above article pays a lot of effort to set up a complete chroot environment.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.