limit user access

Pacux · 10-13-2005, 02:49 AM

howto limit user access so the user can't leave his home directory

mjjzf · 10-13-2005, 06:00 AM

Can't you just chmod -R the whole system, so only the owner can read and write to files?

routers · 10-13-2005, 06:01 AM

Thread (16 views) no one answer

i cant answer you too because not understand what u need pls explain little bit detail

cheers

Pacux · 10-13-2005, 06:10 AM

i think i want the users to view what is in their home directory, and only that. so that a user who try to write cd .. in his home directory only end up in his home directory. the home directory i the users root directory.

mjjzf · 10-13-2005, 06:19 AM

Hehe. You could change the file permissions to make the cd command root-only. But that won't change much if they know the system - they can still fsck up the files. But why can't they leave their /home? It is not as if they can change anything anyway, if they are not root?

Gort32 · 10-13-2005, 06:38 AM

The "proper" way to do this would involve chroot but then you are going to have to set up an entire mini-filesystem withing their home directory. This might be worth it if you are dealing with allowing members of the general public access to your server (e.g. hosting service) but if this is a general-use workstation or a server for a small group I wouldn't worry about it - *nix in general was built form the ground up to be a fully-multiuser system.

ringwraith · 10-13-2005, 06:48 AM

You don't want anything other than their own /home directory to be readable. Do you want any binaries in /bin, /sbin, /usr/ to be executable? The real key is not to give anyone an account that you don't trust.

mjjzf · 10-13-2005, 07:04 AM

Interesting admin approach, RW: Only allow trusted people on the system.

Of course, this would make you a very hungry ISP...
The right thing here would, perhaps, be to play with group settings where users and members of the group 'users' can't see, well, anything but /home. Then other groups can be defined separately. But there is much work in this.

Pacux · 10-15-2005, 04:43 PM

Quote:

Originally posted by Gort32
The "proper" way to do this would involve chroot but then you are going to have to set up an entire mini-filesystem withing their home directory. This might be worth it if you are dealing with allowing members of the general public access to your server (e.g. hosting service) but if this is a general-use workstation or a server for a small group I wouldn't worry about it - *nix in general was built form the ground up to be a fully-multiuser system.

would you explain the usage of chroot to me?

Gort32 · 10-15-2005, 06:26 PM

chroot is pretty complicated...WIkipedia can explain it better than I

Quote:

A chroot on Unix operating systems is an operation which changes the root directory. It affects only the current process and its children. "chroot" itself can refer to the chroot(2) system call or the chroot(8) wrapper program.

A program that is re-rooted to another directory cannot name files outside that directory. This provides a convenient way to sandbox an untrusted, test or otherwise dangerous program. It is also a simple kind of jail mechanism.

In practice, chrooting is complicated by programs expecting at startup to find scratch space, configuration files, device nodes and shared libraries at certain preset locations. To allow programs to spawn inside the chroot directory, it must be populated with a minimum set of these files, preferably carefully chosen so as not to allow unintended access to the outside system.

Programs are allowed to carry open file descriptors (for files, pipelines and network connections) into the chroot, which can simplify jail design by making it unnecessary to leave working files inside the chroot directory. This also works as a simple capability system, in which the program is explicitly granted access to resources outside the chroot based on the descriptors it can carry in.

http://en.wikipedia.org/wiki/Chroot

Like I said, it is rather complicated... Do some research on chroot jail and you should be able to find the answers that you seek.

ringwraith · 10-17-2005, 06:52 AM

OsourceDiplomat: I guess I assumed a Sysadmin for an ISP would not be on LQ asking how to do this. I took him to be a home user that was going to offer shell accounts to his buddies.