I have an embeded linux video server that I just finished. One of the features is that I have a telnet server as well as getty bound to an rs232 port which a user can log into to call a few programs which I have written for server configuration purposes. This is intended to be a backdoor for users if for some reason, the SDK I developed isn't working or they just bought the server and don't have a programmer to put the SDK to use. There is also a web interface, but whatever, the spec says I have to have one.
So for instance, I wrote a program called getIp which allows a user to retrieve network settings and setIp which allows them to set the IP. I have a similar program or script for every function that my .NET based API already does.
However, I do not want them to be able to run any programs other than these. i.e. I don't even want 'ls' or 'cd' to work. I would give them a user name, say "admin", to login to the session with. The question is, how do I setup these restrictions?
Write a program that only gives users the options you wish them to have. Make that program the shell for the users they login as.