Restrict Normal User to run all commands

1. Create user say test.

[root@node ~]# useradd test

[root@node ~]# passwd test

Changing password for user test.

New password:

BAD PASSWORD: it is too short

BAD PASSWORD: is too simple

Retype new password:

passwd: all authentication tokens updated successfully.

2. Create a directory say ‘commands’ under user’s home directory.

[test@node ~]$ pwd

/home/test

[test@node ~]$ mkdir /home/test/commands

3. Modify .bash_profile under user’s home directory.

By default, the environmental variable “PATH” defines the list of directories that contains binary executables which will be called when the user issues a command.

Here we are going to change the PATH variable to user’s home directory/commands folder as follows.

# .bash_profile

# Get the aliases and functions

if [ -f ~/.bashrc ]; then

        . ~/.bashrc

fi

# User specific environment and startup programs

PATH=$HOME/commands

export PATH

4. Now login with test user and try to hit some commands.

[test@node ~]$ ls

-bash: ls: command not found

[test@node ~]$ date

-bash: date: command not found

[test@node ~]$ mv

-bash: mv: command not found

[test@node ~]$ mkdir xyz

-bash: mkdir: command not found

[test@node ~]$ touch ab

-bash: touch: command not found

[test@node ~]$

5. Now create the softlinks of commands which are required for user test to execute in the directory /home/test/commands

Some examples are as follows.

[root@node ~]# ln -s /bin/date /home/test/commands/

[root@node ~]# ln -s /bin/mkdir /home/test/commands/

[root@node ~]# ln -s /bin/touch /home/test/commands/

[root@node ~]# ln -s /bin/ls /home/test/commands/

6. Now re-login as a test user and try above commands.

[root@node ~]# su - test

[test@node ~]$

[test@node ~]$ mkdir abc

[test@node ~]$ date

Sat Jun 10 13:14:27 IST 2017

[test@node ~]$ ls

abc  commands

[test@node ~]$ ls -lrth

total 8.0K

drwxrwxr-x. 2 test test 4.0K Jun 10 13:11 commands

drwxrwxr-x. 2 test test 4.0K Jun 10 13:14 abc

[test@node ~]$