Hey James and all,
I’ve done some research, and something along these lines is absolutely do-able. There are a few options out there and I thought I’d post them here and get some opinions if anyone has tried them:
JailKit: This one is the most mature and has a very competent developer behind it, but is also the most complicated. It sets up a chroot environment for shell users, and includes some tricky wrappers for things like procmail to prevent jail breakage via roundabout methods. It is quite complex in that in order to make the shell useful, we have to drop everything a user is going to use into the jail. This one would take a week or three to integrate into Virtualmin Professional. http://olivier.sessink.nl/jailkit/
ibsh: The Iron Bars Shell. This one is quite new, but looks like it has some great features. It is a very restrictive “deny everything unless told otherwise” shell, with much easier configuration than JailKit. It sounds like it does everything we’d like it to do, but I have concerns about its security due to its young age. There just isn’t enough history to it for us to know if it is truly safe without a code audit (and even then something might get missed)–by the time we’ve audited it, we could have integrated JailKit, which has a track record. Without the audit, it could go into the very earliest beta versions this week. I really like the idea of this one, due to its simplicity…but it’s pointless to choose something simple if it doesn’t work. http://ibsh.sourceforge.net/
scponly: This one is the most restrictive of them all, and probably doesn’t answer everyones needs in this space. On the other hand, it is extremely simple and easy to integrate into Virtualmin Professional, so it is going in whether we choose it as the primary “limited shell” option or not. It’s just a good idea done well. Anyway, it wraps ssh to only permit a very limited subset of features–like scp, sftp, rsync, and CVS. Would this limited feature set be enough for your users that you don’t trust with straight shell access, or do we need to pursue one of the more flexible options? http://www.sublimation.org/scponly/
rssh: Roughly the same as scponly. I’ve found fewer users talking about it, but it’s probably just as good. Worth trying before choosing scponly for the specific problem they solve. http://www.pizzashack.org/rssh/
Thanks in advance for any thought anyone has on this one, or suggestions for other options that might solve the problem.