I will need to create users so developers can log in and clone/pull/push changes/repositories from a github like platform.

I've managed to add a user (using the root) to this CentOS machine; I now have this line in /etc/passwd:


..and this in /etc/shadow:


I am able to SSH the server, I have permission to create a folder and I guess that should be enough. But I am able to see other files and folders outside public_html.

How can I actually restrict the user to a particular directory so he can't "cd out" of his folder?


root@echo [~]# ls -ld /home/moove
drwx--x--x 21 moove moove 4096 Mar 22 16:16 /home/moove/
root@echo [~]# ls -ld /home/moove/public_html
drwxr-x--- 11 moove nobody 4096 Mar 27 11:29 /home/moove/public_html/
root@echo [~]# ls -ld /home/moove/public_html/dev
drwxr-x--- 12 moove nobody 4096 Mar 27 14:47 /home/moove/public_html/dev/
root@echo [~]# ls -ld /home/moove/public_html/dev/arsenal
drwxr-xr-x 3 arsenal moove 4096 Mar 27 14:53 /home/moove/public_html/dev/arsenal/
  • Do you want this user to have an interactive shell or just use sftp to transfer files ? – user9517 Mar 27 '12 at 13:56
  • Thank you for your interest in helping me @Iain, however, cjc's answer helped me and it seems to work! Out of curiosity, I don't know what you mean by "interactive shell"? – Chris Mar 27 '12 at 14:11

You can chroot them, but that leads to complications and additional setup.

If you don't need to fully chroot, you can try using the restricted shell function in bash.

       If  bash  is  started  with  the name rbash, or the -r option is supplied at invocation, the
       shell becomes restricted.  A restricted shell is used to set up  an  environment  more  con-
       trolled than the standard shell.  It behaves identically to bash with the exception that the
       following are disallowed or not performed:

       ·      changing directories with cd
       ·      setting or unsetting the values of SHELL, PATH, ENV, or BASH_ENV
       ·      specifying command names containing /
       ·      specifying a file name containing a / as an argument to the .  builtin command
       ·      Specifying a filename containing a slash as an argument to the -p option to the  hash
              builtin command
       ·      importing function definitions from the shell environment at startup
       ·      parsing the value of SHELLOPTS from the shell environment at startup
       ·      redirecting output using the >, >|, <>, >&, &>, and >> redirection operators
       ·      using the exec builtin command to replace the shell with another command
       ·      adding  or deleting builtin commands with the -f and -d options to the enable builtin
       ·      Using the enable builtin command to enable disabled shell builtins
       ·      specifying the -p option to the command builtin command
       ·      turning off restricted mode with set +r or set +o restricted.

       These restrictions are enforced after any startup files are read.

To implement this, create a link between /bin/rbash and /bin/bash (because CentOS doesn't ship with this link by default): ln /bin/bash /bin/rbash. Then change /etc/passwd so that the user's shell is /bin/rbash.

  • This did the trick for me, thank you very much. Why would I need to fully chroot it, is this if they user will want more rights and access to more commands? Later edit: I'vr finally read what you wrote about Restricted Shell and there's no need for another answer, everything is clear now. Thanks! – Chris Mar 27 '12 at 14:12
  • chroot would imply boxing the user into a tiny replica of the root filesystem, from which they cannot exit. You would have greater control over what they can do, but you would need a greater amount of configuration to get it to work as expected. This would provide greater control over the user's behavior. – cjc Mar 27 '12 at 14:16
  • Quick question, is there anyway I can chmod that home directory by default somehow? I am getting this after login: Could not chdir to home directory /home/moove/public_html/dev/arsenal: Permission denied. – Chris Mar 27 '12 at 15:33
  • @ChrisDemetriad, it's hard to know what permissions are needed, but the chmod would need to be run by a non-rbash user, i.e., done before login. – cjc Mar 27 '12 at 15:39
  • 1
    Try chmod +x /home/moove/public_html /home/moove/public_html/dev – cjc Mar 27 '12 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.