User creation (with only read only access)

pinga123 · 02-03-2011, 02:35 AM

I need to create a user with least permission on the production server.
He should only be able to read or execute the files that to be specific.
For example:
I just need to give him a set of commands to run.Besides those command execution He should be prevented to run any other command and He should not able to create any files(write permission).

How would i proceed about this.

wpeckham · 02-03-2011, 11:59 AM

If he does not need access to any files other than those you place for him to examine, look into IBSH (Iron Bound Shell). With it you can configure EXACTLY what commands the user can execute, and they are ROOTED into their directory tree. What is more, no files in that directory tree can remain executable, links are delinked, etc. to make them VERY well secured.

I modified the source code a while ago to make a version that would allow links out of the home tree to remain. Very nice source, well coded, easy to understand.