I'm needing to work out a way of restricting a user (ssh login on ubuntu 10.04) to only be allowed to do the following:

  • Upload txt files only (through SCP or SFTP)
  • Execute the php command "php somefile.php"

Is this feasible?

  • Can somefile.php be different files or it it really fixed as somefile.php ? – Iain Mar 22 '11 at 8:45
  • @lain - That depends. If I can limit SCP uploads to only txt files, then restricting the php command to only certain scripts isn't as important. What I'm trying to stop is uploading and then executing a php file – Emmanuel Mar 22 '11 at 9:12

You could change the users shell (in /etc/passwd) to a custom shell...

Simple example:

php somefile.php    # You might need to give the full path to the php-bin.
bash -r -c read

Save it in /bin, add it to /etc/shells and make it runnable. The user can still use SCP and SFTP, but when he tries to open a shell, the php will run. If he enters, the shell will close.

  • How does this actually effect a certain user? I'm fairly new with these things. I only want to limit a certainuser. Do I need to add your script to the /etc/passwd file? But won't that then effect all users? – Emmanuel Mar 22 '11 at 9:17
  • In the /etc/passwd you have some options for every user. One of them is their shell, you would need to change it for the user you want to. You would save this in /bin/myawesomeshell. Or if you want to do it via a command, you could use usermod ex: usermod -s /bin/myawesomeshell myuser – Bart De Vos Mar 22 '11 at 9:32
  • @TiZon - so for example I have this someuser:x:5002:5002::/home/someuser:/bin/sh and the /bin/sh is the shell, right? And I change that to mysawsomeshell ? Oh, perhaps usermod would be easiser – Emmanuel Mar 22 '11 at 9:39
  • Yes, usermod would be easier. /bin/shis indeed the shell. – Bart De Vos Mar 22 '11 at 9:40
  • @TiZon - Great! It's working wonderfully now. What are the possibilities with shells? I guess I'll ask Google, but this has been a great help. – Emmanuel Mar 22 '11 at 9:46

It would probably be easier to serve the php script over a web server, and offer a text file upload through the same site. That way you can have incredibly fine control over what's allowed and what's not.

  • Yes, that would. But impossible in my situation. – Emmanuel Mar 22 '11 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.