Allow a UNIX group access to only a single file through SSH

Solution 1:

My solution was to follow Kenneth's comment and set up lshell—was pretty easy and quick to do.

1. Run sudo apt install lshell to get lshell
2. Create a UNIX group (e.g. sudo groupadd testgroup)
3. Add necessary user(s) to your group (e.g. sudo usermod -a -G testgroup username)
4. Also add the user(s) to the lshell group (e.g. sudo usermod -a -G lshell username)
5. Edit /etc/lshell.conf with the desired configuration (see below)
6. Set lshell as the default shell for the user(s) (e.g. chsh -s /usr/bin/lshell username)

With the below configuration, testuser can only run script.py after logging in through SSH. They can't connect with SCP/SFTP or browse the file structure through the shell.

[grp:testgroup]
login_script    : "python /some/path/script.py"
path            : "/some/path/"
forbidden       : ["ls", "echo", "cd"]
scp             : 0
sftp            : 0