# Unix Shell Lockdown **URL:** \ **Category:** Factual Questions\ **Created:** [April 8, 2003, 5:20pm UTC](https://boards.straightdope.com/t/unix-shell-lockdown/167347 "2003-04-08T17:20:32Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![isam](https://avatars.discourse-cdn.com/v4/letter/i/3d9bf3/32.png) [@isam](https://boards.straightdope.com/u/isam)\ **Post date:** [April 8, 2003, 5:20pm UTC](https://boards.straightdope.com/t/unix-shell-lockdown/167347/1 "2003-04-08T17:20:32Z")
how would I go about locking a shell account i created to their home directory? Is this possible (i assume it is)? Thanks in advance for any and all help ---
**Author:** ![spinky](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@spinky](https://boards.straightdope.com/u/spinky)\ **Post date:** [April 8, 2003, 5:32pm UTC](https://boards.straightdope.com/t/unix-shell-lockdown/167347/2 "2003-04-08T17:32:55Z")
What you want is a “restricted shell”. These are shells which can restrict you to a particular directory and/or restrict what programs you can execute, etc. I haven’t used one in a long time, but I think the one I did use was called resh. A google search reveals one called rsh (not to be confused with the other rsh, the remote shell tool), and it looks like if you make a symlink to bash called “rbash” (or give bash the “–restricted” argument), it will start up in a restricted mode as well. Nifty. ---
**Author:** ![spinky](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@spinky](https://boards.straightdope.com/u/spinky)\ **Post date:** [April 8, 2003, 5:41pm UTC](https://boards.straightdope.com/t/unix-shell-lockdown/167347/3 "2003-04-08T17:41:30Z")
Note that you should probably do some research for gotchas involved in relying on a restricted shell. It’s easy to overlook holes, and it’s hard to test for them. I was just experimenting with the restricted bash, and it was indeed restricted, but since bash itself was in my PATH variable, I was able to execute a non-restricted subshell. So obviously there’s one gotcha: set the PATH var conservatively. ---
**Author:** ![Bill\_H](https://avatars.discourse-cdn.com/v4/letter/b/a5b964/32.png) [@Bill\_H](https://boards.straightdope.com/u/Bill_H)\ **Post date:** [April 8, 2003, 7:00pm UTC](https://boards.straightdope.com/t/unix-shell-lockdown/167347/4 "2003-04-08T19:00:57Z")
I’m not exactly sure what the question is in the OP, but assuming a restricted shell is what you’re after, also, check out the “–restricted” option for bash. If a restricted shell isn’t what is being sought, a little expansion, please… Here’s the bash page for the --restricted features: > [@](#): > > 6.10 The Restricted Shell > If Bash is started with the name rbash, or the `–restricted’ option is supplied at invocation, the shell becomes restricted. A restricted shell is used to set up an environment more controlled than the standard shell. A restricted shell behaves identically to bash with the exception that the following are disallowed: > > Changing directories with the cd builtin. > Setting or unsetting the values of the SHELL, PATH, ENV, or BASH\_ENV variables. > Specifying command names containing slashes. > Specifying a filename containing a slash as an argument to the . builtin command. > Specifying a filename containing a slash as an argument to the `-p' option to the hash builtin command. Importing function definitions from the shell environment at startup. Parsing the value of SHELLOPTS from the shell environment at startup. Redirecting output using the `\>’, `>|', `\<\>’, `>&', `&\>’, and `>>' redirection operators. Using the exec builtin to replace the shell with another command. Adding or deleting builtin commands with the `-f’ and `-d' options to the enable builtin. Specifying the `-p’ option to the command builtin. > Turning off restricted mode with `set +r' or `set +o restricted’. ---
**Author:** ![Belrix](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Belrix](https://boards.straightdope.com/u/Belrix)\ **Post date:** [April 8, 2003, 9:14pm UTC](https://boards.straightdope.com/t/unix-shell-lockdown/167347/5 "2003-04-08T21:14:51Z")
If the goal is to give the user an account but not allow a shell login at all then you can change the shell program to a non-shell executable. For some OS’s you then have to add that program to an /etc/shells file. For example, there’s often a /bin/false program that does nothing. Add /bin/false to /etc/shells then change the user’s shell in the seventh field of /etc/passwd to /bin/false. I like using /bin/date. The user logs in, gets the date & time and is then kicked unceremoniously back out.