Restrict SSH commands for a group of users

You will need to create a restricted command shell in the script language of your choice, then set up sshd to force usage of this restricted shell for the group you specify.

Example 8-1 and other following parts of O'Reilly's SSH, The Secure Shell Chapter 8 show ways to do the former.

For the latter, see the Match directive description in sshd_config(5).

As an example, you could add the following to /etc/ssh/sshd_config:

Match Group X
ForceCommand /path/to/your/restricted_shell

I think that the proper way to do that is to combine chroot(controlled/limited environment) with ssh

You may want to have a look to this guide http://www.techrepublic.com/blog/opensource/chroot-users-with-openssh-an-easier-way-to-confine-users-to-their-home-directories/229

not sure it's suitable with your environment or not, i use this on my env. the idea is use restricted bash, clean up $PATH, protect $PATH and set $PATH to $HOME/bin, and then you just symlink all binary that you allowed to run by user to $HOME/bin.

 -------------------------------------------
#!/bin/bash

USERS="user"

PASS=secret
ALLOWED_CMDS="/bin/ping
/usr/bin/killall
/bin/ps
"

# creating restricted bash
ln -s /bin/bash /bin/rbash

for user in ${USERS}; do
        home=/home/${user}
        echo useradd --comment \"CDM user with restricted shell\" --home-dir ${home} --shell /bin/rbash ${user}
        useradd --comment "CDM user with restricted shell" --home-dir ${home} --shell /bin/rbash ${user}
        echo "set password for ${user}"
        echo ${PASS} | passwd ${user} --stdin
        if [ -d ${home} ]; then
                # deleting unneeded files
                files=".bashrc .bash_history .bash_logout .bash_profile  .emacs  .mozilla"
                for file in ${files}; do
                     rm -rfv ${home}/${file}
                done

               # creating bin dir and profile
                echo "export PATH=\$HOME/bin"> /home/$user/.profile
                echo "export PS1=\"[\u@\h \W]$ \"">> /home/$user/.profile

                mkdir ${home}/bin
                chmod -R 755 ${home}
                chown -R root:root ${home}
                chmod 750 ${home}/.profile
                chown root:${user} ${home}/.profile

                chmod 2070 /home/$user
                chown root:$user /home/$user

                # allowed specific commands only
                echo "creating symlinks for allowed commands.."
                for cmd in ${ALLOWED_CMDS}; do
                    ln -sv ${cmd} ${home}/bin/
                done
        fi
done
 -------------------------------------------

 [root@puppet tmp]# sh create_user.sh
 [root@puppet tmp]# su -l user
 [user@puppet ~]$ ping
 Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]
 [user@puppet ~]$ ls
 -rbash: ls: command not found
 [user@puppet ~]$ cd
 -rbash: cd: restricted
 [user@puppet ~]$ pwd
 /home/user
 [user@puppet ~]$ ps
 PID TTY          TIME CMD
 9605 pts/1    00:00:00 rbash
 9629 pts/1    00:00:00 ps
 [user@puppet ~]$ killall
 Usage: killall [-Z CONTEXT] [-u USER] [ -eIgiqrvw ] [ -SIGNAL ] NAME...
 [user@puppet ~]$ nc
 -rbash: nc: command not found
 [user@puppet ~]$ nmap
 -rbash: nmap: command not found