I have an embeded linux video server that I just finished. One of the features is that I have a telnet server as well as getty bound to an rs232 port which a user can log into to call a few programs which I have written for server configuration purposes. This is intended to be a backdoor for users if for some reason, the SDK I developed isn't working or they just bought the server and don't have a programmer to put the SDK to use. There is also a web interface, but whatever, the spec says I have to have one.

So for instance, I wrote a program called getIp which allows a user to retrieve network settings and setIp which allows them to set the IP. I have a similar program or script for every function that my .NET based API already does.

However, I do not want them to be able to run any programs other than these. i.e. I don't even want 'ls' or 'cd' to work. I would give them a user name, say "admin", to login to the session with. The question is, how do I setup these restrictions?


Write a program that only gives users the options you wish them to have. Make that program the shell for the users they login as.

  • #1 I don't know how to do the shell part. Could you tell me how? #2. Could I just limit the path env variable to only include a folder with those programs in it? – Jonathan Henson Oct 27 '11 at 2:26
  • To make the program their shell, just edit /etc/passwd so that their shell (the last parameter) is the full path to that program. – David Schwartz Oct 27 '11 at 4:35
  • thanks, when I looked at the file, it all started making sense. – Jonathan Henson Oct 27 '11 at 16:16
  • Out of curiosity, would #2 work? – Jonathan Henson Oct 27 '11 at 18:15
  • @JonathanHenson: No, because you can run programs outside your path by specifying the full path to those programs. – David Schwartz Oct 27 '11 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.