Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I've been reading various articles about escaping restricted shells, e.g. rbash. I’ve been speaking with friends working in different Linux environments (small, mid-size and huge) and none of them is using restricted shells.
Are restricted shells really used that often or is it more for demonstrative purposes described in various writings?
Restricted shells aren't very useful for system administrators because you actually do need the full power of the shell to do your job to administer a system. What ended up happening if you restrict an admin is that you're just creating another layer of administrator, because ultimately someone need to have the full administrator privilege to administer the permissions for the restricted shell itself.
Restricted shell used to make sense when you have shared servers, where a single large machine that hosts multiple applications/sites often ran by different organisations. The machine administrator may want to delegate some administration privilege to a sub admin and they can do that using restricted shell. Nowadays, with VPS, cloud virtualisation, and containerization becoming much more affordable and more prevalent, it's a lot simpler limit a sub admin's privilege using those mechanisms rather than setting up a shared server with restricted shells.
What restricted shells are good for though, is limited user interface for untrusted users. Nowadays, these use cases are usually served by a web interface, something like Plesk or a custom adminstration interface, so restricted shells no longer really find uses.
Another use cases for restricted shell is to build a shell interface for client-server programs. For example, the git-shell is a restricted shell that can only run certain git server commands (to handle pulls and pushes), this is used to setup an ssh git server or other remote shell interface, without allowing a full blown shell.
I think the decline of usage of restricted shell is mainly because nowadays there's a lot more options to do what used to be sensible use cases for restricted shell. Restricted shell has always been hard to setup, so most people just don't bother with them, and when easier and more secure options come by, the remaining use cases evaporate with them.
No. In my experience, they are (almost) never used.
There used to be an idea that, if you could restrict the shell, you could limit the user's access to the system. However, for a determined user, the restricted shell does not pose a real hindrance.
It could be (and was in the past) used to limit users that have little computer knowledge, to prevent them from doing inadvertently something horribly wrong. However, nowadays, these kind of people do not log in to a shell, but most of the time, they will use a web interface.
