I've read a few things to indicate that restricted shells can be broken out of if not implemented properly (even wikipedia, for instance).
I'm looking for some guidance on what causes security holes in restricted shells and how to solve these problems.
I assume the main problem is the binaries that you allow the user to use; if any of these programs facilitate execution of further programs/scripts with higher privileges.
Does that mean a default rbash shell is relatively secure?
Are there any specific programs that are (more-or-less) definitely safe / not safe (so far I've seen specific examples of vim and scp used to break out)?
And are there other things to think about?
Also, are there better alternatives to using a restricted shell when you want to limit the commands that a user can run?
Following on from what bstpierre mentioned with using ssh command=, has anyone tried using command= to force the user to run a script that took input from the user using SSH_ORIGINAL_COMMAND and then ran limited additional commands/programs based on that input? I imagine this would have quite a limited use-case, but seems viable to me so long as the script was careful about the input it accepted.
The suggestion I made in Update 1 turns out to be exactly what gitolite does; using command= and SSH_ORIGINAL_COMMAND, with some hook magic to differentiate between branches. Info from their docs.
So I know that this method is a viable alternative, but I'm still after an answer to the original query about restricted shells.