Limited remote administration

Question

I'm not sure how to appropriately title this, nor how to approach it.
Basically the situation is like so:
I have a server, which is host to a variety of services; from httpd, to remote gui's for specific tasks on the server; I have remote and local access to all of this, and all of the information stored on the server, including client files, server configuration, and super user.
I have a partner, who only needs access to specific portions of the server.
For example,
My partner needs to be able to access /srv/folder/, preferably as his home directory, though not a gotcha really. This person also needs to be able to remotely execute specific commands, within the scope of the services he requires access to, i.e. sudo systemctl start/stop/restart service
I know I can easily limit him via sudoers by creating a new group, and telling sudo to allow users of said group to execute the above commands.
However, how can I limit the scope of the filesystem he is able to access, I don't want him having access to anything outside of /srv/folder, other than potentially a home folder with limited storage.
Furthermore, how can I limit the availability of commands, for example, lets say he shouldn't need more than:
cp
mv
rm
mkdir
ls
tmux
How can I restrict access to this level?
Most of the access will be via ssh obviously.
Mostly, this is to avoid as much potential human error as possible. I trust myself with the server, but I'm not sure I trust the expertise of my colleague, as Linux is somewhat foreign to him. Backup systems are in place, and everything is redundant, but I shouldn't need to rely on backups, and training shouldn't take place on a live system.

Answer 1

Effectively, yes.
I don't want them able to browse around system files and such freely, nor modify them or use them.
A small set of applications under /usr/bin and a quota'd $HOME as well as access to /srv/folder (multiple occurences here, but not all /srv directories)
I didn't figure it would be horrendously easy either... maybe it would be possible by aliasing all `unavailable` commands to
echo "This user is not permitted to use that command."
or something along those lines.
I've done some reading, and aside from what I suggested above, it seems the only other possible routes are a chroot jail and similar other options. I may try the chroot option and see if that jails him well enough to $home, and then see about making $HOME /srv/, and then explicitly add this user to a restricted group, which will only have r/w access to particular directories. Then, by limiting the restricted group to only execute specific commands via sudoers, I think it should effectively accomplish preventing any uneccesary damage.
Last edited by Xaero252 (2013-01-12 23:17:48)