Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The title may make my question seem absurd, but, hear me out.

The Overview: I am creating a project whereby I'd like my users to be able to connect to the server they are using to audit its authenticity. The site is related to security, privacy, and encryption and as sensitive of a realm that is, I see no better way to show it's the real deal than to just be 100% transparent.

The Question: Is there a secure way to create an extremely limited user account (cd, ls, and less only) which has a permanent blank password and no ability to escalate permissions? Pretty much the only data that will be on this machine is the base OS and the source code to the product.

share|improve this question
Start by looking at rbash. Then perhaps jails or containers. – Neil H Watson Jul 23 '14 at 2:16
up vote 4 down vote accepted

You will need to create a restricted command shell in the script language of your choice, then set up sshd to force usage of this restricted shell for the group you specify.OR as told by @Neil H Watson rbash is good option.


You can also restrict keys to permissible commands (in the authorized_keys file).

I.e. the user would not log in via ssh and then have a restricted set of commands but rather would only be allowed to execute those commands via ssh (e.g. "ssh somehost bin/showlogfile")

For reference:,0

share|improve this answer
This is good information, thanks to you and @Neil H Watson. After some experimenting, it seems these suggestions are going to do exactly what I need. – brian Jul 23 '14 at 14:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.