Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

The title may make my question seem absurd, but, hear me out.

The Overview: I am creating a project whereby I'd like my users to be able to connect to the server they are using to audit its authenticity. The site is related to security, privacy, and encryption and as sensitive of a realm that is, I see no better way to show it's the real deal than to just be 100% transparent.

The Question: Is there a secure way to create an extremely limited user account (cd, ls, and less only) which has a permanent blank password and no ability to escalate permissions? Pretty much the only data that will be on this machine is the base OS and the source code to the product.

share|improve this question
    
Start by looking at rbash. Then perhaps jails or containers. –  Neil H Watson Jul 23 at 2:16

1 Answer 1

up vote 3 down vote accepted

You will need to create a restricted command shell in the script language of your choice, then set up sshd to force usage of this restricted shell for the group you specify.OR as told by @Neil H Watson rbash is good option.

OR

You can also restrict keys to permissible commands (in the authorized_keys file).

I.e. the user would not log in via ssh and then have a restricted set of commands but rather would only be allowed to execute those commands via ssh (e.g. "ssh somehost bin/showlogfile")

For reference:

http://www.linuxjournal.com/magazine/paranoid-penguin-managing-ssh-scripts-and-cron-jobs?page=0,0

http://oreilly.com/catalog/sshtdg/chapter/ch08.html

share|improve this answer
    
This is good information, thanks to you and @Neil H Watson. After some experimenting, it seems these suggestions are going to do exactly what I need. –  brian Jul 23 at 14:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.