Date: Wed, 26 Jul 2000 12:55:56 -0400 From: Kenn Martin <kmartin@infoteam.com> To: freebsd-isp@FreeBSD.ORG Subject: Re: limiting telnet-users Message-ID: <20000726125556.A87381@alydar.infoteam.com> In-Reply-To: <200007241704.TAA13257@ns1.i-p-d.nl>; from chem@i-p-d.nl on Mon, Jul 24, 2000 at 07:15:04PM %2B0200 References: <200007241704.TAA13257@ns1.i-p-d.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Jul 24, 2000 at 07:15:04PM +0200, chem@i-p-d.nl wrote:
> Hi,
>
> I have been investigating a way to limit telnet-users to their own home-dir.
> Problem with chroot is that a lot of dirs would have to be copied to the home-
> dir, in order for them to work with telnet. We only give telnet-access to users
> that specifically ask for it, because ftp is to limited. I remember a post from
> about a year ago, of someone who managed it by setting the permissions of the
> home-dirs and the dir above at a specific way, i believe in combination with a
> specific umask. Can't find that posting in the archives, though.
>
> I would love to hear some solutions to this problem and/or some pointers.
In conjunction with proper permissions, we use the bash shell for the more
privileged users and the restricted version, rbash (or bash -r), for
anyone else that we decide to grant telnet access to (though we usually
require ssh). You can build bash from /usr/ports/shells. You might
evaluate if this matches your needs.
From 'man bash':
RESTRICTED SHELL
If bash is started with the name rbash, or the -r option
is supplied at invocation, the shell becomes restricted.
A restricted shell is used to set up an environment more
controlled than the standard shell. It behaves identi-
cally to bash with the exception that the following are
disallowed or not performed:
o changing directories with cd
o setting or unsetting the values of SHELL, PATH,
ENV, or BASH_ENV
o specifying command names containing /
o specifying a file name containing a / as an argu-
ment to the . builtin command
o importing function definitions from the shell envi-
ronment at startup
o parsing the value of SHELLOPTS from the shell envi-
ronment at startup
o redirecting output using the >, >|, <>, >&, &>, and
>> redirection operators
o using the exec builtin command to replace the shell
with another command
o adding or deleting builtin commands with the -f and
-d options to the enable builtin command
o specifying the -p option to the command builtin
command
o turning off restricted mode with set +r or set +o
restricted.
These restrictions are enforced after any startup files
are read.
When a command that is found to be a shell script is exe-
cuted (see COMMAND EXECUTION above), rbash turns off any
restrictions in the shell spawned to execute the script.
Kenn
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000726125556.A87381>