Limit SSH User to a shell command

Question

My question is

how can I allow an user to ssh to my server with limitation to a shell command and a directory?

My situation

I'm using git to deploy code to my Server. I have 2 servers, 1st one is product server, 2nd one is a git server.

My team use git server to pull/push code.

At my product server, I setup git client. Whenever I want to publish a version, I push it to my git server (master or other branches ...), then I ssh into my product server to pull the code.

I want to share the code pulling privilege with my teammates, but don't want to allow them to run any command but git, and limit them in a directory only.

The owner of directory that I want to limit is apache:apache, so it will be very good if the ssh user run by apache privilege.

Thank you,

Solved: I've used lshell with a limit set of commands.

Answer 1

A simple command to disable the shell in a git user is to replace the /usr/bin/bash with /usr/bin/git-shell. Replace it in the /etc/password file or using the command:

usermod -s /usr/bin/git-shell [username]

Check this document from the official Git website: Setting Up the Server. Additional info if you want to have a shell on it but limiting it to a directory use: rbash. Same as git-shell just replace the user shell with it.