How to jail linux user

Question

Is there something similar to chroot, but for users?

We are about to grant access to our servers for a client and would like them to see only the directories we allow.

Mandola

Isn't that what permissions were designed for? – Limeade

I want to go a bit further than just denying read / write access. – Lottielotto

chroot only denies read/write access. – Limeade

Answer 1

A Google search on "openssh jail" led me to SSHjail for openSSH. If your client uses ssh/scp to access the said servers, this might be what you are looking for.

Tinsmith

Answer 2

The "best answer" from 2009 is outdated. OpenSSH now comes with the ChrootDirectory option. See http://www.debian-administration.org/articles/590 which is for an already-old version of ssh.

Ambulacrum

Answer 3

It is important to note that chroot(2) is not meant for security purposes. It is incredibly easy to escape a chroot jail. See this article on abusing chroot for more information.

Janetjaneta

This should be a comment, not an answer. – Acanthocephalan

Comment non-answer, link-only and link already dead (server down). – Convulsant

Answer 4

If you really want to go to that extreme, SE Linux (or any other mandatory access control) is a definite improvement of the default unix permissions.

Limeade

Answer 5

An effective way to do this is to use lshell

Seiter

Answer 6

No easy way to jail users in their homedirs. BTW, I would NEVER give access to my systems to someone I don't trust a minimum.

Last time I did, I used an "unescapable" menu based on http://bash.cyberciti.biz/guide/A_menu_box The .bashrc launches this script you would not escape :

~/.bashrc :
(LAST LINE)
./menu.sh; exit 0

Yes, I had to write scripts for each and every menu item (get logs, check sys, ...) but nobody to run 'chown -R root:root /' instead of *. Priceless.

[EDIT] : create a dedicated user, don't do this as root !!!

Karolkarola

As mentioned in https://mcmap.net/q/439581/-how-to-limit-user-commands-in-linux-closed a "user could simply script sending a bunch of ^Z or ^C characters to the client right after entering the password to completely abridge any efforts made in the bashrc". lshell seems like the best solution from my reading so far... – Laterite