\section{Restricted Shells and Accounts **}
\begin{frame}
   {Restricted Shell}

   \textbf{Linux} includes a \textbf{restricted shell}, which can be invoked as:
   \begin{cmd}
$ bash -r
   \end{cmd}
   \begin{itemize}
      \item Prevents using \textbf{cd} to change directories
      \item Prevents setting the \texttt{SHELL},
      \texttt{ENV}, or \texttt{PATH} environment variables
      \item Prohibits specifying path or command names
      containing \filelink{/}
      \item Restricts redirection of output and/or input
      \item \textbf{Restricted Accounts} can also be enabled
      by creating a symlink to \filelink{/bin/bash} named
      \filelink{/bin/rbash} and using in
      \filelink{/etc/passwd} as we will discuss next
   \end{itemize}
   \begin{iconbox}[unbreakable]{\textbf{rbash} is not secure!}
      {\importantcolor}{\importanticon} \normalsize

      { It is actually very easy to avoid the restrictions
         and modern techniques such as the use of
         \textbf{SELinux} are much more robust.  We discuss
         only if you encounter the methods described here.  }

   \end{iconbox}

\end{frame}

\cprotect\note{

   For examples of how to defeat the use of restricted
   shells, one hackers guide to do this can be found at
   \url{https://www.metahackers.pro/breakout-of-restricted-shell/}
   and another at
   \url{https://www.exploit-db.com/docs/english/44592-linux-restricted-shell-bypass-guide.pdf}.

   Use of a restricted shell may give a false sense of
   security.

}

\begin{frame}
   {Restricted Accounts}

   There are times when granting access to a user is necessary
   but is limited in scope.  Setting up a restricted user account
   may be the solution.
   \begin{itemize}
      \item Use the restricted shell
      \item Limit available system programs and user
      applications
      \item Limit system resources
      \item Limit access times
      \item Limit access locations
   \end{itemize}

\end{frame}

\cprotect\note{


   When the restricted shell is invoked, it executes
   \url{$HOME/.bash\_profile} without
   restriction. This is why the user must not have either
   write or execute permissions on the home directory.

   Make sure that when you set up such an account that
   you do not inadvertently add system directories to the
   PATH environment variable, because this allows the
   restricted user the ability to execute other system
   programs, such as an unrestricted shell.

   The restricted shell may be invoked with
   \texttt{/bin/bash -r}. Unfortunately, flags may not be
   specified in the \filelink{/etc/passwd} file. If you
   want to use a restricted shell, you need to set up
   a symbolic link or a hard linked file for the shell
   interpreter.

   From the command line, or from a script, a restricted
   shell may be invoked with \texttt{/bin/bash
      -r}. However, flags may not be specified in the
   \filelink{/etc/passwd} file. A simple way to get around
   this restriction would be to do one of the following:

   \begin{cmd}
$ cd /bin ; sudo ln -s bash rbash
$ cd /bin ; sudo ln    bash rbash
$ cd /bin ; sudo cp    bash rbash
   \end{cmd}
   and then use \filelink{/bin/rbash} as the shell in
   \filelink{/etc/passwd}.

   When setting up such an account, one should avoid
   inadvertently adding system directories to the
   \texttt{PATH} environment variable; this would grant the
   restricted user the ability to execute other system
   programs, such as an unrestricted shell.

   Restricted accounts are also sometimes referred to as
   \textbf{limited accounts}.

}

