Ubuntu – rbash: User can fire up regular bash and circumvent restrictions

bashsshUbuntu

I've set up a user account on my Ubuntu server. The user's default shell is rbash. This works great until they type bash at which point they're not restricted to their home directories any longer. How can I remedy this?

Best Answer

You need to restrict the binaries available to the user, rbash is just the first step.

Here is a blog with further details: http://blog.bodhizazen.net/linux/how-to-restrict-access-with-rbash/

For example, you need to change the user's PATH, to exclude the normal directories like /bin, /sbin, /usr/bin, /usr/sbin. Add a new bin directory to their PATH, and copy place safe commands into it.

As well you need to restrict the user's start up files (like .bashrc) to prevent them from changing their path that way.

You could also do a chroot for more security.