On Mon, Jan 11, 2021 at 01:24:46PM -0500, Bill Oliver wrote:
The only thing I know about is putting in a bashrc that limits their
PATH to their own /home/<user>/bin file for executables, and then
adding only the executables I want them to have. So, I guess I could
do that, and just put nothing in the /home/<user>/bin file.
Is there a better way to do this?
Yes. Give them a shell which is not listed in the file `/etc/shells`. There
is a binary `/sbin/nologin` which is traditionally used for this purpose.
sudo usermod -s /sbin/nologin username
.
If you need something more sophisticated than that, you should look at the
PAM authentication stack -- it is possible to configure pretty much any
service so that only users in certain groups are allowed, for example.
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader