How to Block DirectAdmin Commands for Users?

Over a hosting server, server administrators have the last say. They can even assign some of that authority to the user accounts or take it away. Administrators of DirectAdmin servers possess this authority as they can prevent certain commands from being executed by users.

Administrators are able to:

Stop all user accounts from using the DirectAdmin commands.

Block certain users’ access to the DirectAdmin commands.

Block DirectAdmin Commands for all the User Accounts

The never_commands setting in /usr/local/directadmin/conf/directadmin.conf file will block commands globally and for all the users on the server.

The syntax to block commands with the never_commands setting:

never_commands=COMMAND

For example,

never_commands=CMD_ACCOUNT_ADMIN:CMD_API_ACCOUNT_ADMIN

It will block the commands to create new admin accounts.

For the command to take effect, restart DirectAdmin:

service directadmin restart

Block the DirectAdmin Commands for Specific Users.

For specific users, blocking commands requires a bit of preparation.

1. Create files commands.allow and commands.deny. These files are very similar to the CSF files – csf.allow and csf.deny.

/usr/local/directadmin/data/users/USERNAME/commands.allow
/usr/local/directadmin/data/users/USERNAME/commands.deny

Let’s see what to put in these files-

• commands.allow: The DirectAdmin commands that the user is allowed to use.
• commands.deny: The DirectAdmin commands you want to deny/block for the user.

Rules to Create the commands.allow and commands.deny Files

1. Enter one command per line.
2. If a command is present in both commands.allow and commands.deny files, the user is allowed to use the command.
3. If the commands.allow file is empty, i.e. there are no commands in it, the system will block every command for the user.
4. Users cannot use the commands exceeding their access level even after adding them to commands.allow.

The moment a user tries to execute a command you have denied or blocked, DirectAdmin will give an error message.

Here are the links where you can find all the DirectAdmin commands:

https://www.directadmin.com/api.html
https://www.directadmin.com/search_versions.php?help=no&versions=yes&query=CMD_API_
https://www.directadmin.com/search_versions.php?help=no&versions=yes&query=CMD_ 

You can block these commands globally or for a specific user on your DirectAdmin server.