Sponsored Content
Full Discussion: Restrict user access
Operating Systems Linux Red Hat Restrict user access Post 302582860 by hedkandi on Sunday 18th of December 2011 11:12:50 PM
Old 12-19-2011
Restrict user access

Hi there

I have an application user on my system that wants accesses to these file systems as such:

rwx:

/SAPO
/SAPS12
/R3_888
/R3_888B
/R3_888F
/R3_888R

r:
/usr/sap

these are the existing FS permissionsSmiliewnerships:

Code:
[root@H99A100 ~]# ls -ld /SAPO
drwxrwxr-x 64 ZODCIFUSR ODCgrp 12288 Nov 25 11:02 /SAPO

[root@H99A100 ~]# ls -ld /SAPS12
drwxrwxr-x 5 s12adm ODCgrp 4096 Nov  7 13:49 /SAPS12

[root@H99A100 ~]# ls -ld /R3_888
drwxrwxr-x 129 s12adm ODCgrp 4096 Nov 10 09:56 /R3_888

[root@H99A100 ~]# ls -ld /R3_888B
drwxrwxr-x 31 s12adm ODCgrp 4096 Nov  7 15:03 /R3_888B

[root@H99A100 ~]# ls -ld /R3_888F
drwxrwxr-x 43 s12adm ODCgrp 4096 Nov 21 17:16 /R3_888F

[root@H99A100 ~]# ls -ld /R3_888R
drwxrwxr-x 4 s12adm ODCgrp 4096 Nov  7 15:03 /R3_888R

[root@H99A100 ~]# ls -ld /usr/sap
drwxrwxr-x 5 s12adm sapsys 4096 Oct 25 22:16 /usr/sap

the user:

Code:
[root@H99A100 ~]# id ZODCIFUSR
uid=2020(ZODCIFUSR) gid=200(ODCgrp) groups=200(ODCgrp),0(root) context=root:system_r:unconfined_t:SystemLow-SystemHigh

so how do i go by providing user ZODCIFUSR access to the file systems stated above without setting ACLs on the system? (or is ACLs the only way to do it?)

right now, he's in group 0, so he can pretty much access all the FS but this is just a temp workaround

I was thinking of adding the user to supplementary groups on which the FS are grouped (i.e. sapsys, ODCgrp)

please help, if ACLs is the way to do it, please let me know because i am not very good with the commands

thank you
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

restrict tcp-port access

Hi Is there any way to restrict the TCP-IP port usage. I want to restrict TCP-IP port 1500/1550 to the oracle osuser. Tanks in advance. Remi (2 Replies)
Discussion started by: remivisser
2 Replies

2. HP-UX

How to restrict a user group to access the kernel

Hi, Please any one can help me to know that how we can restrict a user group to access the kernel at all. (0 Replies)
Discussion started by: harishankar
0 Replies

3. Red Hat

restrict access of a user to two directories only

Hi all, I am using RHEL 5.0 I need a user say test to have full access to two directories, say /tmp1 & /tmp2 only other than his home directory. I do not want to change his login shell which is ksh or bash by default. Moreover, he should not even have read access of other directories. ... (10 Replies)
Discussion started by: vikas027
10 Replies

4. UNIX for Advanced & Expert Users

Restrict FTP access to a single directory for only one user.

Hi All, It will be very great if you can help me in this issue. Thanks in advance. I need to enable FTP on a solaris9 server. I need to create a new user some "xxxxxx" and he can only FTP the files to and from between /tftpboot directory and network devices. Other users should not... (8 Replies)
Discussion started by: santhoshkumar_d
8 Replies

5. UNIX for Dummies Questions & Answers

Restrict user access to their home dir

Hi! i'm using FreeBSD 6.2 and hosting my pc to frens in particular of sensitive information being saved to the PC, i would like to know is it possible for me to restrict user access to their /home dir. only? and also, i wanted to restrict them listing files under /etc thanks all! (10 Replies)
Discussion started by: rdns
10 Replies

6. UNIX for Advanced & Expert Users

Restrict access to specific users.

Hi All! I would like to know if there is any specific way by which I can restrict access to apecific users (ip addresses). OS : Red hat linux Thanks! nua7 (6 Replies)
Discussion started by: nua7
6 Replies

7. UNIX for Advanced & Expert Users

Restrict Access to the folder

Hi I have requirement to create 3 new users on my server but to restrict their access to a set of particular folders. /export/home/kapil/shared, /export/home/kapil/shared/Folder1 /export/home/kapil/shared/Folder2 These folders should be accessible to all the 3 users and to me too.... (1 Reply)
Discussion started by: kapilk
1 Replies

8. UNIX for Dummies Questions & Answers

Restrict user access.

Hi All, How can we restrict a particular user access to a particular shell in solaris 10. Thanks in Advance. (5 Replies)
Discussion started by: rama krishna
5 Replies

9. Ubuntu

Restrict SUDO Access

Linux ubuntu 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:56:25 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux Hi Folks, Please help me. I am bit struck here. Here is the OS info. Linux ubuntu 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:56:25 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux I have a... (17 Replies)
Discussion started by: explorer007
17 Replies

10. UNIX for Dummies Questions & Answers

Restrict access

I'm trying to use squid to restrict elinks' access to certain websites(only http traffic). I have tried some configs in squid.conf but no luck. Hope someone has a bit of time to explain me how can you make these config's :) ---------- Post updated at 05:40 PM ---------- Previous update was at... (1 Reply)
Discussion started by: Birnbacher
1 Replies
lockfs(1M)						  System Administration Commands						lockfs(1M)

NAME
lockfs - change or report file system locks SYNOPSIS
/usr/sbin/lockfs [-adefhnuw] [-c string] [file-system]... DESCRIPTION
lockfs is used to change and report the status of file system locks. lockfs reports the lock status and unlocks the file systems that were improperly left locked. Using lockfs to lock a file system is discouraged because this requires extensive knowledge of SunOS internals to be used effectively and correctly. When invoked with no arguments, lockfs lists the UFS file systems that are locked. If file-system is not specified, and -a is specified, lockfs is run on all mounted, UFS type file systems. OPTIONS
The options are mutually exclusive: wndheuf. If you do specify more than one of these options on a lockfs command line, the utility does not protest and invokes only the last option specified. In particular, you cannot specify a flush (-f) and a lock (for example, -w) on the same command line. However, all locking operations implicitly perform a flush, so the -f is superfluous when specifying a lock. You must be super-user to use any of the following options, with the exception of -a, -f and -v. The following options are supported. -a Apply command to all mounted, UFS type file systems. file-system is ignored when -a is specified. -c string Accept a string that is passed as the comment field. The -c only takes affect when the lock is being set using the -d, -h, -n, -u, or -w options. -d Delete-lock (dlock) the specified file-system. dlock suspends access that could remove directory entries. -e Error-lock (elock) the specified file-system. elock blocks all local access to the locked file system and returns EWOULDBLOCK on all remote access. File systems are elocked by UFS on detection of internal inconsistency. They may only be unlocked after successful repair by fsck, which is usually done automatically (see mount_ufs(1M)). elocked file systems can be unmounted. -f Force a synchronous flush of all data that is dirty at the time fsflush is run to its backing store for the named file system (or for all file systems.) It is a more reliable method than using sync(1M) because it does not return until all possible data has been pushed. In the case of UFS filesystems with logging enabled, the log is also rolled before returning. Additional data can be modified by the time fsflush exits, so using one of the locking options is more likely to be of general use. -h Hard-lock (hlock) the specified file-system. hlock returns an error on every access to the locked file system, and cannot be unlocked. hlocked file systems can be unmounted. -n Name-lock (nlock) the specified file-system. nlock suspends accesses that could change or remove existing directories entries. -u Unlock (ulock) the specified file-system. ulock awakens suspended accesses. -v Enable verbose output. -w Write-lock (wlock) the specified file-system. wlock suspends writes that would modify the file system. Access times are not kept while a file system is write-locked. OPERANDS
The following operands are supported. file-system A list of path names separated by whitespace. Note that file-system can be a directory rather than the specific name of a file system, such as / or /usr. For example, if you specify /export/home as an argument to a lockfs command and /export/home is mounted on the root (/) file system, the lockfs command will take effect on the root file system. USAGE
See largefile(5) for the description of the behavior of lockfs when encountering files greater than or equal to 2 Gbyte ( 2^31 bytes). EXAMPLES
Example 1 Using lockfs -a In the following examples, filesystem is the pathname of the mounted-on directory (mount point). Locktype is one of "write," "name," "delete," "hard," or "unlock". When enclosed in parenthesis, the lock is being set. Comment is a string set by the process that last issued a lock command. The following example shows the lockfs output when only the -a option is specified. example# /usr/sbin/lockfs -a Filesystem Locktype Comment / unlock /var unlock example# Example 2 Using lockfs -w The following example shows the lockfs output when the -w option is used to write lock the /var file system and the comment string is set using the -c option. The -a option is then specified on a separate command line. example# /usr/sbin/lockfs -w -c "lockfs: write lock example" /var example# /usr/sbin/lockfs -a Filesystem Locktype Comment / unlock /var write lockfs: write lock example example# Example 3 Using lockfs -u The following example shows the lockfs output when the -u option is used to unlock the /var file system and the comment string is set using the -c option. example# /usr/sbin/lockfs -uc "lockfs: unlock example" /var example# /usr/sbin/lockfs /var Filesystem Locktype Comment /var unlock lockfs: unlock example example# ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Availability |SUNWcsu | +-----------------------------+-----------------------------+ SEE ALSO
kill(1), mount_ufs(1M), sync(1M), attributes(5), largefile(5), ufs(7FS), DIAGNOSTICS
file system: Not owner You must be root to use this command. file system :Deadlock condition detected/avoided A file is enabled for accounting or swapping, on file system. file system: Device busy Another process is setting the lock on file system. SunOS 5.11 2 Jan 2008 lockfs(1M)
All times are GMT -4. The time now is 07:25 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy