special-purpose user account

[santanudas]

Hi all,

I have a really tricky requirement. I need to create a special-purpose user account, by giving it a shell which only allows the ‘sftp-server’ and a set of commands, namely ‘passwd’ ‘ls’ and ‘cd’ (ls & cd within the ~user directory only).

Initially, I replaced '/bin/bash' by '/usr/libexec/openssh/sftp-server' in
‘/etc/passwd’ for that particular user to run sftp-server ONLY. The trick is working but I want the user to change his/her password time to time and issue ‘ls’ and ‘cd’ to list ONLY the files inside his/her home directory. Now, as I changed the ‘/bin/bash’ part, if you do, say 'ssh $user@abc.com' it's asking for the password and after the password it's not doing ANY thing (as expected). My second question is: In stead of not doing any thing how can I print a massage like: "You are not allowed to use a shell" or something like that. Is it possible?

Thanks in advace!!!!

 

[santanudas]

Ohhhh...I forgot to tell you guys that I'm using FC2 - if that helps.....

 

[thedaver]

If you root/jail the user to their homedir within SFTP - see thread earlier this week on using a patch to do that - then you're almost all the way home. This would allow controlled access to their homedir plus ls and cd.

I'm not quite sure how you'd use a specific shell to ONLY allow the user to change passwd. I'll bet some smart person has stripped a bash shell for that purpose and you could rig up an ssh session for that user to accomplish it.

I just don't see how you can integrate these two without a lot of custom coding.

http://www.surfinbox.com/loans/

 

[santanudas]

Many thanks, thedaver for your comment. could you pls point me the earlier thread that you mentioned?

And another question, mybe a stupid one - why you think it's really difficult use a specific shell to ‘ONLY allow the user to change password’? What did you actually mean – ONLY user or ONLY change password?

 

[thedaver]

Earlier thread re: patching sftp to chroot user to homedir

http://www.tek-tips.com/viewthread.cfm?qid=913067

On the comment about a shell, I meant that most shells are ready to run a multitude of commands, some available through the shell and most available through the path and local directory. I wasn't confident that any user could be confined to only having a shell to change passwords because I wasn't confident that such a shell exists... I may be proven wrong on this...

http://www.surfinbox.com/loans/

 

[santanudas]

Many thanks thedaver, for those links. those are really very helpful. I got another plans to do now with those.
Thanks again!!!!