Restrict user access Post: 302583589

Sponsored Content

Operating Systems Linux Red Hat Restrict user access Post 302583589 by hedkandi on Tuesday 20th of December 2011 09:45:54 PM

12-20-2011

Registered User

Solved

Thank you verdepollo, I checked my disks and the partition, none of them even show any output when i run the tune2fs -l command (output shows the result for one of the disk)

Code:

[root@H99A100 dev]# ls -lrt sd*
brw-r----- 1 root disk 8,  2 Nov 22 22:30 sda2
brw-r----- 1 root disk 8,  0 Nov 22 22:30 sda
brw-r----- 1 root disk 8,  1 Nov 22 22:31 sda1
brw-r----- 1 root disk 8,  3 Nov 25 15:14 sda3
brw-r----- 1 root disk 8, 16 Nov 28 13:46 sdb
brw-r----- 1 root disk 8, 32 Nov 28 13:46 sdc
[root@H99A100 dev]#

[root@H99A100 dev]# tune2fs -l /dev/sdb
tune2fs 1.39 (29-May-2006)
tune2fs: Bad magic number in super-block while trying to open /dev/sdb
Couldn't find valid filesystem superblock.

none of the existing FS on the system is ACL supported, as per mount command

Code:

/dev/mapper/vgSAP-lv_s12_03 on /usr/sap/trans type ext3 (rw)

I doubt the client will agree with remounting the FS with acl mount option, but would it possible to create ACL anyways, without the FS mount options being ADL enabled? What would be the consequences to this?

Thanks again for the full command, I've always been wary of ACLs Smilie

---------- Post updated at 06:45 PM ---------- Previous update was at 06:27 PM ----------

So I tested this on my test server, but the weird thing is when I did mount, all the other FS but /tmp is acl enabled, even after manually enabling acl for /tmp

Code:

my-xftp0:~ # tune2fs -l /dev/sda8
tune2fs 1.41.9 (22-Aug-2009)
Filesystem volume name:   <none>
Last mounted on:          <not available>
Filesystem UUID:          1d4351d3-dbf5-42b8-9b78-a29b7dcf5e9c
Filesystem magic number:  0xEF53
Filesystem revision #:    1 (dynamic)
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype needs_recovery sparse_super large_file
Filesystem flags:         signed_directory_hash 
Default mount options:    (none)
Filesystem state:         clean
Errors behavior:          Continue
Filesystem OS type:       Linux
Inode count:              655360
Block count:              2620603
Reserved block count:     131030
Free blocks:              2537308
Free inodes:              655216
First block:              0
Block size:               4096
Fragment size:            4096
Reserved GDT blocks:      639
Blocks per group:         32768
Fragments per group:      32768
Inodes per group:         8192
Inode blocks per group:   512
Filesystem created:       Thu Nov 17 11:44:04 2011
Last mount time:          Wed Dec  7 15:30:06 2011
Last write time:          Wed Dec  7 15:30:06 2011
Mount count:              8
Maximum mount count:      -1
Last checked:             Thu Nov 17 11:44:04 2011
Check interval:           0 (<none>)
Reserved blocks uid:      0 (user root)
Reserved blocks gid:      0 (group root)
First inode:              11
Inode size:               256
Required extra isize:     28
Desired extra isize:      28
Journal inode:            8
Default directory hash:   half_md4
Directory Hash Seed:      b38a25f8-9d33-45c8-81ef-b51c55d4fba2
Journal backup:           inode blocks

check out the FS in blue, they were acl enabled all along

Code:

my-xftp0:~ # mount
/dev/sda1 on / type ext3 (rw,acl,user_xattr)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
debugfs on /sys/kernel/debug type debugfs (rw)
devtmpfs on /dev type devtmpfs (rw,mode=0755)
tmpfs on /dev/shm type tmpfs (rw,mode=1777)
devpts on /dev/pts type devpts (rw,mode=0620,gid=5)
/dev/sda2 on /boot/efi type vfat (rw,noexec,nosuid,nodev,gid=100,umask=0002,utf8=true)
/dev/sda4 on /home type ext3 (rw,acl,user_xattr)
/dev/sda7 on /opt type ext3 (rw,acl,user_xattr)
/dev/sda8 on /tmp type ext3 (rw)
/dev/sda5 on /usr type ext3 (rw,acl,user_xattr)
/dev/sda6 on /var type ext3 (rw,acl,user_xattr)
fusectl on /sys/fs/fuse/connections type fusectl (rw)
securityfs on /sys/kernel/security type securityfs (rw)

attempting to set /tmp acl enabled failed:

Code:

my-xftp0:~ # mount -o remount, acl /tmp
my-xftp0:~ # tune2fs -l /dev/sda8 | grep -i acl
my-xftp0:~ #

nonetheless, attempting to set user test with read permissions for /tmp worked

Code:

my-xftp0:~ # setfacl -m d:u:test:r /tmp
my-xftp0:~ # 
my-xftp0:~ # getfacl /tmp
getfacl: Removing leading '/' from absolute path names
# file: tmp
# owner: root
# group: root
# flags: --t
user::rwx
group::rwx
other::rwx
default:user::rwx
default:user:test:r--
default:group::rwx
default:mask::rwx
default:other::rwx

oh by the way, the test machine I play around is a suse linux machine

Code:

my-xftp0:~ # cat /proc/*version
Linux version 2.6.32.12-0.7-default (geeko@buildhost) (gcc version 4.3.4 [gcc-4_3-branch revision 152973] (SUSE Linux) ) #1 SMP 2010-05-20 11:14:20 +0200

...weird no?

hedkandi

View Public Profile for hedkandi

Find all posts by hedkandi

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

restrict tcp-port access

Hi Is there any way to restrict the TCP-IP port usage. I want to restrict TCP-IP port 1500/1550 to the oracle osuser. Tanks in advance. Remi

2. HP-UX

How to restrict a user group to access the kernel

Hi, Please any one can help me to know that how we can restrict a user group to access the kernel at all.

3. Red Hat

restrict access of a user to two directories only

Hi all, I am using RHEL 5.0 I need a user say test to have full access to two directories, say /tmp1 & /tmp2 only other than his home directory. I do not want to change his login shell which is ksh or bash by default. Moreover, he should not even have read access of other directories. ...

4. UNIX for Advanced & Expert Users

Restrict FTP access to a single directory for only one user.

Hi All, It will be very great if you can help me in this issue. Thanks in advance. I need to enable FTP on a solaris9 server. I need to create a new user some "xxxxxx" and he can only FTP the files to and from between /tftpboot directory and network devices. Other users should not...

5. UNIX for Dummies Questions & Answers

Restrict user access to their home dir

Hi! i'm using FreeBSD 6.2 and hosting my pc to frens in particular of sensitive information being saved to the PC, i would like to know is it possible for me to restrict user access to their /home dir. only? and also, i wanted to restrict them listing files under /etc thanks all!

6. UNIX for Advanced & Expert Users

Restrict access to specific users.

Hi All! I would like to know if there is any specific way by which I can restrict access to apecific users (ip addresses). OS : Red hat linux Thanks! nua7

7. UNIX for Advanced & Expert Users

Restrict Access to the folder

Hi I have requirement to create 3 new users on my server but to restrict their access to a set of particular folders. /export/home/kapil/shared, /export/home/kapil/shared/Folder1 /export/home/kapil/shared/Folder2 These folders should be accessible to all the 3 users and to me too....

8. UNIX for Dummies Questions & Answers