Rbash Restricted Bash Shell: What It Does and Limits

Rbash (restricted bash) is a mode of the Bash shell that limits what a user can do after logging in, primarily by preventing them from changing directories, setting certain environment variables, or running commands with slashes. You enable it by launching bash with the -r flag, invoking it as rbash, or setting it as a user’s login shell. It is not a full security sandbox—it is a convenience restriction that a determined user can often bypass—so it is best used as a guardrail, not a jail.

What Exactly Does Rbash Restrict?

When Bash runs in restricted mode, it enforces a specific list of limitations. The most important ones are:

You cannot use the cd command to change directories. You are stuck in the directory where the shell started.
You cannot set or unset the PATH, SHELL, BASH_ENV, or ENV variables.
You cannot run any command that contains a slash (/). So ls works, but /bin/ls does not. This also means you cannot run scripts like ./script.sh.
You cannot redirect output using >, >>, >|, or <.
You cannot use the exec builtin to replace the shell.
You cannot add or remove builtin commands with enable -f or enable -d.
You cannot use the command builtin to bypass restrictions (e.g., command ls is blocked).
You cannot use hash -p to add a command with a slash.
You cannot turn off restricted mode with set +r or set +o restricted.

These restrictions apply only after the shell starts. The startup files (.bash_profile, .bashrc) are read before restricted mode is fully active, so they can set up the environment you want the user to have.

How Do You Enable Rbash?

There are three common ways to start a restricted Bash shell:

Use the -r flag: Run bash -r from a normal shell. This starts a restricted subshell.
Invoke it as rbash: If you create a symlink or copy of the bash binary named rbash, Bash detects that it was called with that name and enters restricted mode automatically.
Set it as a user’s login shell: In /etc/passwd or with chsh, set the user’s shell to /bin/rbash (or the path to your rbash binary). When they log in, they get a restricted shell immediately.

For example, to create an rbash binary on most Linux systems:

sudo ln -s /bin/bash /bin/rbash

Then you can set a user’s shell to /bin/rbash with chsh -s /bin/rbash username.

Why Use Rbash? Typical Use Cases

Rbash is often used to give a user access to a limited set of commands without letting them roam the filesystem or change their environment. Common scenarios include:

Creating a “guest” account that can run only a few utilities like ls, cat, or less in a specific directory.
Providing a support or data-entry user with a menu-driven script that they can run, but preventing them from opening a general shell.
Limiting what a remote user can do over SSH if you set their shell to rbash.

For example, you might create a user whose .bash_profile sets PATH=/usr/local/bin and then runs a custom menu script. Because the shell is restricted, they cannot change to another directory or run arbitrary commands with slashes.

What Rbash Does NOT Protect Against

This is the most important part to understand. Rbash is not a security boundary. A user who is even moderately skilled can often break out. Here are the known bypasses:

If any command they can run is a shell script or a program that spawns a subshell, they can get a full shell. For example, if vi or less is available, they can use :!bash or !bash to escape.
If they can run env or export (which are not restricted by default), they might set BASH_ENV to a script that runs when a new bash starts, then invoke bash somehow.
If they can use ftp, sftp, or scp, they can copy files to and from the system, potentially overwriting startup files.
If the user has write access to their own .bashrc or .bash_profile, they can edit it to run arbitrary commands next login.
If they can run python, perl, or awk, they can use those to spawn a shell.

Because of these holes, rbash is best used as a mild restriction to prevent accidental mistakes, not to contain a malicious user. For real security, you need a proper sandbox like a container, a VM, or SELinux/AppArmor.

Common Mistakes When Setting Up Rbash

People often make a few errors when configuring rbash:

Not setting PATH correctly. If you do not set a limited PATH in the startup files, the user inherits the default system PATH, which may include directories like /usr/local/bin or /usr/bin where they can run many commands. You should set PATH to a directory you control, containing only symlinks to the allowed commands.
Leaving write access to home directory. If the user can write to their home directory, they can create a .bashrc that runs arbitrary code next time they log in. Make the home directory read-only or at least the startup files read-only.
Allowing commands that can escape. Even a simple command like grep can be used to read files, but worse, find with -exec can run commands. You must whitelist only what is absolutely needed.
Thinking rbash is a jail. As noted, rbash is not a security tool. It is a convenience restriction. Do not rely on it to protect sensitive data.

How to Make Rbash More Secure (If You Must)

If you still want to use rbash, you can reduce the risk of escape by following these practices:

Create a dedicated bin directory (e.g., /home/user/bin) and symlink only the specific commands you want to allow. For example: ln -s /bin/ls ~/bin/ls.
Set PATH to that directory only, and make it read-only.
Make the user’s home directory and all startup files owned by root and not writable by the user.
Disable any command that can spawn a subshell or run external programs: vi, less, more, man, ftp, sftp, scp, python, perl, awk, find, gcc, etc.
Consider using a restricted menu script as the only command the user can run.

Even with all this, a determined user might still find a way out. For true isolation, use a container or a dedicated VM.

Alternatives to Rbash

If rbash is not secure enough, what else can you use?

rbash with a restricted PATH (as above) is a bit better, but still not foolproof.
Bash’s --restricted flag is the same as rbash.
Other restricted shells: rsh (restricted shell, not remote shell) is a separate program that is even more limited, but it is rarely installed by default. rzsh is the restricted version of Zsh.
Command-line menus: Write a custom script that presents a menu and only runs predefined commands. This is often safer than rbash because the user never gets a shell prompt.
Containers (Docker, LXC, etc.): Run the user in a container with a read-only filesystem and no network access. This provides real isolation.
SSH forced commands: In ~/.ssh/authorized_keys, you can prefix a command to force the user to run only that command when they connect.

Frequently Asked Questions

Can I escape rbash?

Yes, in many cases. If you can run any command that can spawn a subshell (like vi, less, python, or awk), you can get a full shell. Also, if you can write to your own startup files, you can inject commands for next login. Rbash is not a security boundary.

What is the difference between rbash and a normal bash shell?

A normal bash shell has no restrictions—you can change directories, set environment variables, run commands with slashes, and redirect output. Rbash disables all of those. It is like a normal shell but with a set of “training wheels” that prevent many common operations.

How do I set rbash as a user’s login shell?

First, create an rbash binary (e.g., sudo ln -s /bin/bash /bin/rbash). Then use chsh -s /bin/rbash username or edit /etc/passwd to set the user’s shell to /bin/rbash. When they log in, they will get a restricted shell.

Does rbash work with SSH?

Yes, if you set the user’s login shell to rbash, SSH will use it. However, be aware that SSH can still allow port forwarding, X11 forwarding, or SFTP unless you disable those in sshd_config. Those features can also be used to bypass restrictions.

Is rbash the same as a chroot jail?

No. A chroot jail changes the apparent root directory for a process, restricting file access to a subtree. Rbash only restricts shell builtins and command paths. They are complementary but not equivalent. A chroot is generally more secure, but still not bulletproof.

Can I use rbash to prevent a user from running a specific command?

Not directly. Rbash blocks all commands with slashes, but if the command is in the PATH (a directory like /usr/bin), the user can run it. To prevent a specific command, you must remove it from the PATH or use a wrapper that checks the command name. A better approach is to use a menu script that only runs allowed commands.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →