LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 06-17-2005, 04:54 PM   #1
Verbal Kint
Member
 
Registered: Apr 2004
Posts: 99

Rep: Reputation: 15
User Accounts


Hello,

I am new to Linux and I need some help on user accounts. I would like to create an account for a friend of mine with just read acess to directories. I have created the user with the utility Webmin but I can't find an area to specify any types of permissions/privledges. I logged in with the account I created for him and it basically gives him root access. It allows him to delete files/dirs ctc. Any help would be greatly appreciated.

Thanks
 
Old 06-17-2005, 05:24 PM   #2
Noth
Member
 
Registered: Jun 2005
Distribution: Debian
Posts: 356

Rep: Reputation: 30
You can't specify read-only access in the user account, you have to use filesystem permissions. Unless your distribution is really f'd up, I doubt he has anything close to root priviledges.
 
Old 06-17-2005, 05:28 PM   #3
Verbal Kint
Member
 
Registered: Apr 2004
Posts: 99

Original Poster
Rep: Reputation: 15
Thank you,

One last question, how do you find out what filesystem permissions a given user has?

Thanks!
 
Old 06-17-2005, 05:32 PM   #4
Noth
Member
 
Registered: Jun 2005
Distribution: Debian
Posts: 356

Rep: Reputation: 30
Look at the files and compare to what groups they're in? On any sane distribution a newly created user would only have write access to /home/username, /tmp and /var/tmp.
 
Old 06-17-2005, 05:46 PM   #5
Verbal Kint
Member
 
Registered: Apr 2004
Posts: 99

Original Poster
Rep: Reputation: 15
Thanks again!

Is there any way to lock a user in their home directory?
 
Old 06-17-2005, 05:54 PM   #6
Noth
Member
 
Registered: Jun 2005
Distribution: Debian
Posts: 356

Rep: Reputation: 30
Possibly, it depends on what you're trying to accomplish. Why are you creating him an account if you don't want him to be able to do anything with it?
 
Old 06-17-2005, 06:10 PM   #7
Verbal Kint
Member
 
Registered: Apr 2004
Posts: 99

Original Poster
Rep: Reputation: 15
Well it is very weird but in order to connect to our home comptuers from behind our work firewall, we must first use SecureCRT to connect to a linux box and then configure port forwarding within SecureCRT. I was hoping there was a way to lock him in his home directory and don't want to give him the ability to navigate to other dirs...

Any ideas?
 
Old 06-17-2005, 06:16 PM   #8
Noth
Member
 
Registered: Jun 2005
Distribution: Debian
Posts: 356

Rep: Reputation: 30
What's wrong with him seeing what's in /usr/bin? It's distributed on the CD for free...

So you're saying to connect to work from home, you have to ssh into the work firewall, setup port forwarding to the work server you want to access and then connect to the forwarded port?

You could try setting his shell to /bin/rbash which is a restricted bash shell. I don't think it'll affect SSH's ability to do port forwarding, but you should test it first.
 
Old 06-17-2005, 06:22 PM   #9
Verbal Kint
Member
 
Registered: Apr 2004
Posts: 99

Original Poster
Rep: Reputation: 15
No, we have to ssh to a linux box @ my house and then configure SecureCRT to port forward for it to work. I just don't want him to see the contents in my /home/jeff/public_html directory.
 
Old 06-17-2005, 06:23 PM   #10
Noth
Member
 
Registered: Jun 2005
Distribution: Debian
Posts: 356

Rep: Reputation: 30
If you have the rights set properly on your home directory he won't be able to.
 
Old 06-17-2005, 06:28 PM   #11
Verbal Kint
Member
 
Registered: Apr 2004
Posts: 99

Original Poster
Rep: Reputation: 15
Hey,

Well that would be the problem I guess ......I bet you can already guess my next question...LOL.....I logged in with his user and he is able to navigate to my home directory. Any idea how I can set the rights on my home diretory so I can only view it?

Thanks!
 
Old 06-17-2005, 06:45 PM   #12
Noth
Member
 
Registered: Jun 2005
Distribution: Debian
Posts: 356

Rep: Reputation: 30
Well since I assume you want Apache to be able to get to /home/jeff/public_html but not your friend. Off the top of my head you have two options.

1) Give the Apache's primary group access to your home directory (chgrp www-data /home/jeff and chgrp -Rf www-data /home/jeff/public_html) and then remove access from 'other' (chmod -Rf o-rwx /home/jeff).

2) Leave the ownership the way it is and just restrict your top level home directory. Apache just really needs execute permission on the directories leading up to public_html to be able to get into it, so you could run "chmod o-rw /home/jeff" and whenever someone tries to get a file list from /home/jeff they'll get Access Denied. But if they know that public_html exists, they can still get to it.
 
Old 06-18-2005, 01:11 AM   #13
emetib
Member
 
Registered: Feb 2003
Posts: 482

Rep: Reputation: 33
kaiser,
i believe that you're trying to do all of this from a command line? or are you using a browser interface?

if you're using a command line, and/or a browser you can just set up acls, access control lists. if you're using reiserfs then you're going to have to rebuild your kernel to support it, if you're using ext3 or xfs then it's in there all ready.

you won't have to play with your apache settings for this.
also if you're using apache to see your /home/user files, then you have a big security hole in the first place.

here's a link for you.-
http://www.suse.de/~agruen/acl/linux-acls/online/
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
user accounts metallica1973 Linux - Security 2 06-19-2005 06:35 PM
User Accounts Kemik Linux - Newbie 13 01-12-2005 05:24 PM
User Accounts MrJoshua Linux - General 3 01-10-2003 09:30 AM
User Accounts petey *BSD 4 09-26-2002 10:28 AM
User Accounts afair Linux - Newbie 3 09-19-2002 01:57 PM


All times are GMT -5. The time now is 04:57 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration