0

I've been reading various articles about escaping restricted shells, e.g. rbash. I’ve been speaking with friends working in different Linux environments (small, mid-size and huge) and none of them is using restricted shells.

Are restricted shells really used that often or is it more for demonstrative purposes described in various writings?

2
  • While you dont come across them often, there are some use-cases where restricted shells are handy. Preconfigured servers that are provided by the manufacturers as OVA downloads are one example. While you still want the user to be able to use some basic commands, you dont want him to fuck up the entire machine and therefore restrict the access. – Valentin Apr 23 '20 at 10:29
  • Restricted shells exist but you may not know you are looking at them. Self Service Kiosks are often implemented as restricted shells. – user10216038 Apr 24 '20 at 17:39
2

No. In my experience, they are (almost) never used.

There used to be an idea that, if you could restrict the shell, you could limit the user's access to the system. However, for a determined user, the restricted shell does not pose a real hindrance.

It could be (and was in the past) used to limit users that have little computer knowledge, to prevent them from doing inadvertently something horribly wrong. However, nowadays, these kind of people do not log in to a shell, but most of the time, they will use a web interface.

2
  • I see it the same way but I don’t understand why it is such a popular subject (addressed in almost every course, article about hacking etc.) ? – user211245 Apr 23 '20 at 9:41
  • I must say, that I haven't seen the restricted shell in any recent course or article lately. But for some reason, educators like to dwell on the past. For example: for a long time, SNA has been part of general network courses, even when it was as good as extinct. – Ljm Dullaart Apr 24 '20 at 8:58
2

Restricted shells aren't very useful for system administrators because you actually do need the full power of the shell to do your job to administer a system. What ended up happening if you restrict an admin is that you're just creating another layer of administrator, because ultimately someone need to have the full administrator privilege to administer the permissions for the restricted shell itself.

Restricted shell used to make sense when you have shared servers, where a single large machine that hosts multiple applications/sites often ran by different organisations. The machine administrator may want to delegate some administration privilege to a sub admin and they can do that using restricted shell. Nowadays, with VPS, cloud virtualisation, and containerization becoming much more affordable and more prevalent, it's a lot simpler limit a sub admin's privilege using those mechanisms rather than setting up a shared server with restricted shells.

What restricted shells are good for though, is limited user interface for untrusted users. Nowadays, these use cases are usually served by a web interface, something like Plesk or a custom adminstration interface, so restricted shells no longer really find uses.

Another use cases for restricted shell is to build a shell interface for client-server programs. For example, the git-shell is a restricted shell that can only run certain git server commands (to handle pulls and pushes), this is used to setup an ssh git server or other remote shell interface, without allowing a full blown shell.

I think the decline of usage of restricted shell is mainly because nowadays there's a lot more options to do what used to be sensible use cases for restricted shell. Restricted shell has always been hard to setup, so most people just don't bother with them, and when easier and more secure options come by, the remaining use cases evaporate with them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.