[急问]如何创建只能执行Ping命令的用户！！大家帮忙啊

youlei

今天领导让我给业务员创建一个  主要是一个执行ping 命令的用户。 要求其他权限都没有


主要应用于 让业务员登陆到服务器 看看到对方主机的速度。:help :help :help


在线等待

要求业务员远程ssh登陆主机  锁定其根目录 ~

shell限制

除了下列
ls
cd
tracroute
tcptump
rm
telnet
ping
ps
top
vi
ssh
touch
mkdir

其余命令全部屏蔽掉。

超级用户

这么强啊？

编辑那个用户的.bashrc，
让它一旦登录就chroot到一个只后ping命令的环境下，不知道可行否？

seamonkey

把它的shell设置为rbash，单独设置路径，路径中只包含ping命令。

pdaliu

楼上说的听起来好像可行啊!

youlei

服务器上没有rbash

怎么锁定这个用户不能出自己的目录啊？

jail  “牢笼”程序可以做到吗？

怎么设置啊 网上的方案好像行不通啊。

我的需求是：
要求远程ssh登陆主机  锁定其根目录 ~

shell限制

除了下列
ls
cd
tracroute
tcptump
rm
telnet
ping
ps
top
vi
ssh
touch
mkdir

其余命令全部屏蔽掉。

youlei

The Restricted Shell

If Bash is started with the name rbash, or the `--restricted' option is supplied at invocation, the shell becomes restricted. A restricted shell is used to set up an environment more controlled than the standard shell. A restricted shell behaves identically to bash with the exception that the following are disallowed:

Changing directories with the cd builtin.
Setting or unsetting the values of the SHELL or PATH variables.
Specifying command names containing slashes.
Specifying a filename containing a slash as an argument to the . builtin command.
Importing function definitions from the shell environment at startup.
Parsing the value of SHELLOPTS from the shell environment at startup.
Redirecting output using the `>', `>|', `<>', `>&', `&>', and `>>' redirection operators.
Using the exec builtin to replace the shell with another command.
Adding or deleting builtin commands with the `-f' and `-d' options to the enable builtin.
Specifying the `-p' option to the command builtin.
Turning off restricted mode with `set +r' or `set +o restricted'.

seamonkey

http://www.linuxsir.cn/bbs/showt ... amp;highlight=rbash

如果是nvi或vim在PATH中，用户可以通过它们运行其它本地命令，甚至是不受限制的shell。