restricting a user's access to a single directory

cliffyman · 08-19-2002, 09:00 AM

Simple question here: how can I restrict a user's access to ONLY their home directory? I don't want them to be able to read any other directories on the server. Obviously right now they can browse just about anywhere on the server without actually doing anything, but I just want them to be able to work with files in their home dir. Can someone let me know how to do this? Thanks!

turnip · 08-19-2002, 12:32 PM

cd into the users dir and chown the .. to root and chmod it so world cant execute it and he should be locked in

edit..

never mind, cannot login if you do that=p oh well. you can start chrooting processes the users are using to log in, that will lock them in a directory for sure

Malicious · 08-19-2002, 07:18 PM

man bash

Check out the -r execution option. This restricts the user to polite activities (no cd, no changing shells, etc.). Use rbash (which is the same as "bash -r") as the users login shell. Don't forget to add rbash to /etc/shells.

kill-hup · 08-22-2002, 12:22 PM

Restricted shells can be a deterrent, but note that scripts and programs can easily circumvent the shell restriction. Your best bet is to create a chroot'ed environment with local statically-linked binaries in the user's home dir.

I guess the larger question is why you would want this person on the machine, if they can't be trusted to play nicely

Turn on accounting if you're paranoid.