read only access

mario.almeida · 07-27-2009, 07:38 AM

Hi All,

Any idea how to give read only access to a particular user if login from a specific IP?

eg:

user xyz log in to the server (ssh) from ip 10.200.2.1 has full access
user xyz log in to the server (ssh) from ip 10.200.2.20 has read access

//Remy

acid_kewpie · 07-27-2009, 09:08 AM

This is not a valid security model, you would need to think more carefully about what you're trying to achieve in order to have alevel of security. Additionally it makes no sense to ask about "full access" and such when they are getting shell access to a multi-user system. no one other than root should have "full access" anyway...

mario.almeida · 07-28-2009, 12:52 AM

Quote:

Originally Posted by acid_kewpie

This is not a valid security model, you would need to think more carefully about what you're trying to achieve in order to have alevel of security. Additionally it makes no sense to ask about "full access" and such when they are getting shell access to a multi-user system. no one other than root should have "full access" anyway...

I've not made my self clear

what I mean by full access it not to the system root access

xyz user is a normal users have access to a file eg a log file /var/log/maillog

If that user login to the system from IP 10.200.2.1 can modify delete that file
If the same user login to the system from different ip 10.200.2.20 can only view that file

this is just an example

any idea how to achieve this with out creating new user?

//Remy

acid_kewpie · 07-28-2009, 01:02 AM

Again, that's really a bad model. your IP address is such an arbitrary piece of data. I think you need to think about what you need to actually achieve and come up with a better way of doing it.

mario.almeida · 07-28-2009, 01:48 AM

Quote:

Originally Posted by acid_kewpie

Again, that's really a bad model. your IP address is such an arbitrary piece of data. I think you need to think about what you need to actually achieve and come up with a better way of doing it.

Thanks for the reply, need to think of some other options eg new user