Let me introduce you to a few friends, only 3 for now. Hopefully these will answer your question: * nologin: https://man7.org/linux/man-pages/man8/nologin.8.ht

Let me introduce you to a few friends, only 3 for now. Hopefully these will answer your question: * nologin: https://man7.org/linux/man-pages/man8/nologin.8.html https://man7.org/linux/man-pages/man8/nologin.8.html * scponly: https://linux.die.net/man/8/scponly https://linux.die.net/man/8/scponly * git-shell: https://git-scm.com/docs/git-shell https://git-scm.com/docs/git-shell If your policy is instead to fire up a full blown unrestricted bash shell, then hope the user doesn't exit your script before you swap it with a restricted shell, I've got some surprises for you. Even if you trust your users, every one of them is a potential doormat for a malicious user to wipe their feet on as they use leaked credentials. Moral of the story: the stuff is there for a reason and it's easy to use. Might as well do it. Most of the vintage useless stuff is long gone, if it's there it's probably still important.