Hi

I have created a new user say abc. His dome directtory is /home/abc. I need to restrict this user from accessing any directories other than one inside /home/abc. He should be able to view, edit, delete, write all the files and directories inside /home/abc. But he should not be able to list, or access any files or directories outside /home/abc. How can I achive this. Please help me.

Thanks
Albin

You should look at setting up a chroot "jail" for the user.

Type "man chroot" for more information. Many tutorials exist for setting up jails.

I am not familiar with the chroot method described above.

Do you want the user to be able to run system SW and utilities? If so, then he/she needs read and execute status to places like /bin /sbin and /usr. Please describe in more detail what you are trying to accomplish.

let me do a search on that.

Ofcourse he should be able to run the system SW and utilities. What I mean is that he should not be able to read other users data.

Thanks to all
Albin

The chroot method involves creating a filesystem hierarchy inside the jail. So you could have to copy many of the programs in /bin, /usr/, /etc, etc for that user to be able to function. If that user will be using a gui environment, then there will be a lot of packages to install to the chroot'ed directory. It would be better if you make sure that the other users' home directories don't have the "o"ther bits set, and that the new user isn't a member of the group of any of the users.

If you have a directory that you mount for your own use, then make sure you are the owner and group owner of the file and use "rwx------". For fat32 and ntfs filesystems, you can use the "uid=<your-username>,gid=<your-primary-group>,fmask=0177,dmask=0077" options. This will give you exclusive control.

chmod -R g-r,o-r /home (turns off read access for all of /home for everyone except the owner of the file/directory---and of course the root user)

It's worth studying man chmod and man chown and trying experiments---there is unlimited power and flexibility.

Thanks to all