Friday, October 30, 2009

Restrict ssh/ftp user from leaving the home directory - Or grant access to specific directory

This script is tested from Bash and Ksh shell.
Edit the user .profile and add the following lines.
################################
typeset -xf _cd
function _cd
{
\cd $*
if grep "${PWD}" /.approved_dirs > /dev/null 2>&1; then
return
fi
\cd $OLDPWD
return
}
alias cd=_cd
####################################
This script will check if the user is trying to do a cd to any other folder other than listed in .approved_dirs. If its listed, it will allow the user to cd to the folder else it will drop the uesr to his old pwd directory. Which is his home directory.
To restrict the user from editing his .profile or .approved_dirs change the permission to 644 for the files.
Pitfall: If the user uses "alias cd=cd" then the above script will not work. Or if th user changes the default shell, the settings will fail. Preferably can be used for sftp user.
This document is picked from the link below - Many thanks to the contributor - I am placing it here so that its easily accessible to me and others refereing my blog for help.

1 comment:

Anonymous said...

great points altogether, you simply won a new reader. What
could you suggest about your publish that you just made a few days in the past?

Any certain?

Here is my web-site ... location voiture longue duree