Freeze user in one directory Post: 302431518

Sponsored Content

Operating Systems AIX Freeze user in one directory Post 302431518 by bakunin on Tuesday 22nd of June 2010 05:00:26 AM

06-22-2010

Registered User

Quote:

Originally Posted by Mr.AIX

for exsample I want to denied that user to access /usr , /root , /var .... etc

This is not quite possible: if you deny a user access to the "/usr" tree he will not be able to execute any commands stored there - which, in case of the "/usr" hierarchy - includes all the commands a Unix system has. The user would, for instance, not even be allowed to change his password, because the "passwd" command lives in "/usr/bin/passwd".

Of course there is "chroot", as has been mentioned, but this means basically replicating the (relevant part of the whole) system into a single directory, creating a copy of the /usr tree, etc.. You still will need to give the user access to at least these copies, otherwise you have the same situation as before. Further, the user has to log into the system to do some (meaningful) work: it might be possible that the restrictions you put onto the account at the same time prevent the account from doing anything meaningful at all.

You might explore the "restricted shell" ("ksh -r") to achieve your desired functionality, but even this is IMHO a desperate measure.

As long as you get your authentication model and your privilege model right you don't need to fall back to these solutions of last resort, though - not in most of the cases, that is. It doesn't hurt if a user can see something, as long as he isn't able to change it - which is, why there are "r" bits and "w" bits to set on a directory and file level.

So, as long as you don't explain which situation calls for such outrageous security mechanisms the best advice i can give you is: don't do it. Use normal file/directory restrictions instead, not even considering ACLs.

I hope this helps.

bakunin

bakunin

View Public Profile for bakunin

Find all posts by bakunin

8 More Discussions You Might Find Interesting

1. Linux

How to trace the module after system freeze?

Hi, I wrote a kernel module that did a virtual network protocol and library that provide interface for application use to interact with the kernel module by ioctl actions. insmod the module and unload the module, there will be no problem. But once I call the library with my example...

2. Solaris

Restricting SFTP user to a defined directory and home directory

Hi, I've created solaris user which has both FTP and SFTP Access. Using the "ftpaccess" configuration file options "guest-root" and "restricted-uid", i can restrict the user to a specific directory. But I'm unable to restrict the user when the user is logged in using SFTP. The aim is to...

3. SCO

Help on System Freeze in SCO

Hi, My SCO server freezes suddenly. I just want to know if there any tools / commands availble that can find which is causing the freeze? Any help on this would be greatly appreciated. Regards, Ravikumar R

4. SCO

SCO 6.0 Freeze

Hi Gurus I have installed SCO 6.0 open server on Dell R710 server. It has frozen three times afte installtion. and I had to cold reboot to bring the server back again. I need to know where to look for the reason it froze. The keyboard on the server the asterisk key is pressed, even...

5. Linux

grub2 startup freeze

I got a dual boot with grub2, but everytime I turn on the computer and the booter is loaded, I can't handle the menu, so I am forced to wait the countdown and choose the default option. I'd really like to know why! This is my grub.cfg, # # DO NOT EDIT THIS FILE # # It is automatically...

6. Solaris

Solaris 11 install freeze

Hi, I tried to boot the Solaris 11 install DVD the other day and I can't get past the "SunOS" text banner on the clear/newscreen. It just hangs with a solid block cursor. I have a new computer and that might be the problem, but what I want is more verbosity maybe, some kind of detailed...

7. Cybersecurity

Freeze system

hello is there any freeze software for Linux-redhat system to prevent any changes on /root (wish open topic on right forum)

8. Solaris

SunOS confusing root directory and user home directory

Hello, I've just started using a Solaris machine with SunOS 5.10. After the machine is turned on, I open a Console window and at the prompt, if I execute a pwd command, it tells me I'm at my home directory (someone configured "myuser" as default user after init). ...

LEARN ABOUT DEBIAN

ideviceinstaller

ideviceinstaller(1)					      General Commands Manual					       ideviceinstaller(1)

NAME

       ideviceinstaller - Manage iDevice apps

SYNOPSIS

       ideviceinstaller [OPTIONS]

DESCRIPTION

       Allows to install, upgrade, uninstall, archive, restore and enumerate installed or archived apps on iDevices.

OPTIONS

   General options:
       -d, --debug
	      enable communication debugging.

       -U, --uuid UUID
	      target specific device by its 40-digit device UUID.

       -h, --help
	      prints usage information

   Commands:
       -l, --list-apps
	      list apps installed on the device.

	      Additional options:

	      -o list_user
		     list user apps only (apps installed by the user) This is the default.

	      -o list_system
		     list system apps only (apps available from the system firmware)

	      -o list_all
		     list all types of apps

	      -o xml print output in xml format (PList)

       -i, --install ARCHIVE
	      install app from a package file specified by ARCHIVE.

       -u, --uninstall APPID
	      uninstall app specified by APPID.

       -g, --upgrade APPID
	      upgrade app specified by APPID.

       -r, --restore APPID
	      restore archived app specified by APPID.

       -L, --list-archives
	      list archived applications on the device.

	      Additional options:

	      -o xml print output in xml format (PList)

       -a, --archive APPID
	      archive app specified by APPID.

	      Additional options:

	      -o uninstall
		     uninstall the package after making an archive

	      -o app_only
		     archive application data only

	      -o copy=PATH
		     copy the app archive to directory PATH when done

	      -o remove
		     only valid when copy=PATH is used: remove after copy

       -R, --remove-archive APPID
	      remove app archive specified by APPID.

AUTHOR

       This manual page was written by Martin Szulecki.

															       ideviceinstaller(1)