Restricting User Environments with Restricted Shells

In this lesson, you will learn how to create a "jail-like" environment for specific users by limiting the commands and directory access they have available using a restricted shell.

The Concept of a Restricted Shell

Normally, when a user logs in, they are dropped into a full-featured shell (like /bin/bash) that allows them to navigate anywhere in the filesystem, execute any binary they have permission to access, and change environment variables. This is often too much access for service accounts or untrusted users.

A restricted shell, such as rbash (a restricted version of Bash), imposes specific constraints:

1. You cannot use cd to change directories.
2. You cannot set or unset environment variables like PATH or SHELL.
3. You cannot execute commands that contain a / character (preventing the execution of files in other directories).
4. You cannot redirect output using >, >>, or |.

Implementation: Setting the Jail

To implement this, you first define a specific directory where the user is allowed to "live."

1. Create the restricted environment: Create a bin directory for the user and symlink only the necessary binaries there:

   mkdir -p /home/restricteduser/bin
   ln -s /bin/ls /home/restricteduser/bin/ls
   ln -s /bin/echo /home/restricteduser/bin/echo
   

2. Assign the shell: Change the user’s shell to rbash in /etc/passwd:

   usermod -s /bin/rbash restricteduser
   

3. Lock the environment: Now, configure the user's PATH so they can only see the binaries you put in their custom bin folder. When the user logs in, the shell will only allow them to execute commands found in that folder, effectively preventing them from traversing the system or running unauthorized tools. By combining this with immutable storage mounts (which you learned in a previous lesson), you can ensure the user cannot even modify the scripts they are allowed to run.

This approach creates a sandbox that mitigates the risk of a user wandering outside their designated workspace, turning a standard account into a highly contained service environment.

Key Takeaway: Restricted shells enforce a "least privilege" environment by limiting directory navigation and command execution to a pre-defined set of permitted binaries.