Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Need to create a restricted user(Centos)
Top Forums UNIX for Dummies Questions & Answers Need to create a restricted user(Centos) Post 302351476 by ankushpandit on Tuesday 8th of September 2009 04:22:34 PM
Old 09-08-2009
Data Need to create a restricted user(Centos)
Hi,
I am a newbie to Linux and I want to create a user which can only execute network config commands like ifconfig and ping(to check the config). The following is what I did but failed.
1) Created a group called 'netconfig'.
2) added a user named 'user'.
3) added user to the 'netconfig' group.
4) Changed the permissions on /bin and /sbin directories so that only groups 'root' and 'netconfig' can Read & execute.
The Result
1) I can execute ping and ifconfig commands when I log on as 'root' and can configure the network(as Default ofcourse).
2) The problem arises when I execute this command and get the following response.
[A]
/bin/ping x.x.x.x [enter]
ping: icmp open socket: Operation not permitted
[B]
/sbin/ifconfig [enter]
eth0 Link encap:Ethernet HWaddr 00:00:00:00:00:00
inet addr:x.x.x.x Bcast:x.x.x.255 Mask:255.255.255.0
inet6 addr: aaaa::aaaa:aaaa:aaaa:9999/00 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1320 errors:0 dropped:0 overruns:0 frame:0
TX packets:991 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:138423 (135.1 KiB) TX bytes:178569 (174.3 KiB)
Memory:d0200000-d0220000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:2343 errors:0 dropped:0 overruns:0 frame:0
TX packets:2343 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2709476 (2.5 MiB) TX bytes:2709476 (2.5 MiB)
[this seems to work fine till I dont execute the following line]
[C]
/sbin/ifconfig eth0 down [enter]
SIOCSIFFLAGS: Permission denied
I have 2 questions
a} Am I at a right path for my goal, i.e. Am I doing right steps for creating a user which has only access to 'ifconfig' and 'ping' command?
b} Is there a better way for creating a restricted user with access to only 2 commands?
Please help with this. Any examples and experiences are welcome.
Thanks in advance,
Ankush Pandit.


ps: Sorry I forgot to mention I am using CentOS 5.2 and I also tried jailkit but failed Smilie
 

10 More Discussions You Might Find Interesting

1. Cybersecurity

Restricted user

A few of the other employees here need to learn "vi" in order to use crontab to schedule / unschedule jobs on one of our production servers. I tried to set up a login on one of my Linux boxes for them to use "vimtutor", but scrapped it and decided to try for something more secure, since there are... (1 Reply)
Discussion started by: LivinFree
1 Replies

2. Solaris

How to set restricted user by rksh? Cannot use Perl module DBD::Oracle

Hi, all, I need to add a user to our system in order to let him use Oracle and Perl. We want him to remain in his home directory and have no access to our data and other users' files. I created a separate group for this user, and set his shell to rksh when I created his account, by which he... (2 Replies)
Discussion started by: alanlh
2 Replies

3. Shell Programming and Scripting

To provide restricted access to certain user's on linux box

Hi, I need to provide execute access to certain users and not to all users For ex: if ther is a file /home/august/aug.sh. and there are user's like jan,feb,mar,april,May and jan is the owner of that box. I need to provide execute access to feb and mar only. I also know the root pwd for... (3 Replies)
Discussion started by: Ashok_oct22
3 Replies

4. AIX

A user with restricted ftp access to a folder

Hi, We have Oracle Database on AIX 5.3 server.We want to give ftp access to a user to a specific folder.He should be able to put and get files from that specific folder only.Moreover he should not be able to cd to any other filesystems also along with root directory. Please note that as per... (1 Reply)
Discussion started by: dwiravi
1 Replies

5. UNIX for Dummies Questions & Answers

User should be restricted moving a folder

Hi All , Some of the users should be restricted using the MV commands on some of the standard folders. We had an issue the other day like from the standard folder structure which was set up one of the user has moved a folder to a different location and the jobs failed as the folder was not... (6 Replies)
Discussion started by: perlamohan
6 Replies

6. Solaris

Create user with Restricted Space usage

Hi, What is the command or how to create a user with the restricted usage of space on a disk. Also let me know how to change the limit of the space size allotted in future for the same user. ~Vinodh Kumar V M (3 Replies)
Discussion started by: vino_hymi
3 Replies

7. Solaris

create a restricted user

I have solaris 10 os 64 bit. I need to create a restricted user which has the following command to run ls df and du list crontab of root and edit crontab of root also please help (2 Replies)
Discussion started by: reyazan
2 Replies

8. AIX

Restricted user

Hello everyone I need to create a restricted user or a special user. Here is what I need. I have this path next to profiles I have server1, server2, server3....... The user that I have to create I need that he can move between server1. server2, server3 because in every one have logs... (1 Reply)
Discussion started by: lo-lp-kl
1 Replies

9. Red Hat

how to create hidden account in centos

hi everybody, iam using 32bit centos 6.2 on my machine, and i want to create hidden user 'test' , i mean to say while iam starting my centos at GUI mode, at that time that username 'test' should not appear at list of users, only i can use that username is command line. logging in through... (1 Reply)
Discussion started by: paruhang
1 Replies

10. Debian

Create restricted user for programs

want to create a user account for each of the key programs installed on my debian server. For example, for the following programs: Tomcat Nginx Supervisor PostgreSQL This seems to be recommended based on my reading online. However, I want to restrict these user accounts as much as possible,... (3 Replies)
Discussion started by: Spadez
3 Replies

LEARN ABOUT OSF1

iptunnel

iptunnel(8)						      System Manager's Manual						       iptunnel(8)

NAME

       iptunnel - Creates, deletes, and displays configured tunnels

SYNOPSIS

       /usr/sbin/iptunnel  [operation] [args]

DESCRIPTION

       The  iptunnel  command creates configured tunnels for sending and receiving IPV6 or IPV4 packets that are encapsulated as the payload of an
       IPV4 datagram.

       The iptunnel command can perform one of the following operations: Creates a tunnel interface, which  you  must  subsequently  configure	by
       using the ifconfig command. The syntax of the create operation is as follows:

	      iptunnel create [-I int-name] [v4-dest] [v4-src]

	      Specifies  the  interface unit of the tunnel to be created. This is an optional parameter.  The int-name parameter has the following
	      form: iptx, where x is the interface unit number. By default, the interface name selected for the tunnel is iptx+1, or the value	of
	      the  interface  unit  number  of the last tunnel created plus 1.	Specifies the remote end-point to which a tunnel is to be created.
	      Sets the IPV4 source address in the encapsulating header.  The tunnel is enabled (packets are sent/received on the tunnel)  only	if
	      v4-src  is  a valid address on the system.  This is an optional parameter.  Deletes a tunnel interface.  You must disable the tunnel
	      before you can delete it by executing the following command: # ifconfig tunnel name down	delete abort Shows the	tunnel	attributes
	      (name, tunnel end points, next hop for tunneled packets).

EXAMPLES

       To create a tunnel from hobbes to calvin, enter: # iptunnel create -I ipt5 calvin  ipt5  iftype 208 src 16.140.16.86 dst 16.140.16.91

       To display the tunnel attributes, enter: # iptunnel show ipt5 interface ipt5 src 16.140.16.86 dst 16.140.16.91 gate 16.140.16.86 To config-
       uring the tunnel to encapsulate IPv6 packets, enter: # ifconfig ipt5 ipv6 up

	      IPv6 packets will be sent as payloads of IPv4 datagrams from 16.140.16.86 to 16.140.16.91.

	      The tunnel may also be used to send IPV4 packets encapsulated within IPV4 headers as follows: # ifconfig	ipt5  10.10.80.60  netmask
	      255.255.255.0

	      To verify the previous command, enter: # ifconfig ipt5 ipt5: flags=4c1<UP,RUNNING,NOARP,MULTICAST>
		   16.140.16.86 --> 16.140.16.91
		   rxmt 1000, reach time 30000, dad tries 1, mtu 1280, hops 64, token len 64
		   inet 10.10.80.60 netmask ffffff00  ipmtu 1280
		   inet6  fe80::108c:1056  To  deleting the tunnel, enter: # ifconfig ipt5 down delete abort ipt5: delete inet address 10.10.80.60
	      10.10.80.60: aborting 0 tcp connection(s)

	      Then, enter: # iptunnel delete ipt5 interface ipt5 deleted

SEE ALSO

       Commands: ifconfig(8).

       RFC 2003, IP Encapsulation within IP, Perkins, C., October 1996

																       iptunnel(8)
All times are GMT -4. The time now is 10:13 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy