Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Stop root from writing to directory
Top Forums UNIX for Advanced & Expert Users Stop root from writing to directory Post 303041309 by Neo on Thursday 21st of November 2019 05:01:56 AM
Old 11-21-2019
On a similar topic....

On some servers I manage, I have configured PAM to enable Google Authenticator for certain commands.

For example, on some servers, I have configured PAM to require Google Authenticator for sudo.

So, depending on your risk management profile, you could configure PAM to require Google Authenticator for chattr (or any other command you want to add 2FA) ; and only have one admin with their GA set up (and keep that mobile phone, for example, locked away in safe if you need added security).

Anyway, not to belabor this point; but you can use PAM and GA to add 2FA to just about any command you wish. I use it for sudo, sshd, and others and it works well. When set up this way, even root needs 2FA for access.

Again, depending on your risk management profile, that may be "enough", or it may not be "enough".
This User Gave Thanks to Neo For This Post:
hicksd8
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

What files are writing to a directory

Is there a way to tell what files/scripts are writing/wrote to a given directory? (3 Replies)
Discussion started by: hattorihanzo
3 Replies

2. Shell Programming and Scripting

writing script to clean up a directory

I have to do a directory clean up on several machines. The task is as follows: go to a particular directory (cd /xxx) 1. create a directory ' SCRIPTCLEANUP ' ( i KNOW IT) loop through 2. List the directory 3. if directory and start with 'DQA' leave it, 4. if directory or file move it to... (0 Replies)
Discussion started by: ajaya
0 Replies

3. UNIX for Dummies Questions & Answers

how to stop to current directory using find

Hello, I just want to ask the following use of find command: 1. how can I find files only to the current directory? 2. how can I find files to directories and all subdiretories (are this include soft links?) but will not go to other mountpoints that is under that mountpoint. Im combining... (1 Reply)
Discussion started by: james_falco
1 Replies

4. Shell Programming and Scripting

stop unix find on a directory structure after finding 1st occurrence

Hi, Has anyone tried to restrict Solaris 10 unix find on a large directory structure based on time to stop running after finding the first occurrence of a matching query. Basically I'm trying to build up a usage map of user workspaces based on file modification (week/month/3 months/year etc) and... (3 Replies)
Discussion started by: jm0221
3 Replies

5. UNIX for Dummies Questions & Answers

How to display only Owner and directory/sub directory names under particular root

hai, I am new to Unix, I have a requirement to display owner name , directory or sub directory name, who's owner name is not equal to "oasitqtc". (here "oasitqtc" is the owner of the directory or sub directory.) i have a command (below) which will display all folders and sub folders, but i... (6 Replies)
Discussion started by: gagan4599
6 Replies

6. Shell Programming and Scripting

Writing Script to Copy Newest Directory

I am trying to write a script that once executed it will search within a directory and copy only the newest directory that has not been copied before to a new location. Kind of like what ROBOCOPY /M does in windows? The directories are not left in the new location so using a sync action won't... (2 Replies)
Discussion started by: Keriderf
2 Replies

7. Shell Programming and Scripting

Shell script to poll a directory and stop upon an event

Need shell script to: 1/keep polling a directory "receive_dir" irrespective of having files or no files in it. 2/move the files over to another directory "send_dir". 3/the script should only stop polling upon a file "stopfile" get moved to "receive_dir". Thanks !! My script: until do... (0 Replies)
Discussion started by: iaav
0 Replies

8. What is on Your Mind?

Stop Writing Scripts

Please, I beg you, “Stop!” Yes, stop writing scripts and instead build workflows. Programmers, Sys-Admins, System Support, I'm talking to you. Ok, I know in this community I'm going to get some serious backlash for my statements but I truly believe in my statement. There was a time when... (13 Replies)
Discussion started by: mikemazz
13 Replies

9. UNIX for Dummies Questions & Answers

Removing directory with leading hyphen from root directory

I know that this basic question has been asked many times and solutions all over the internet, but none of the are working for me. I have a directory in the root directory, named "-p". # ls -l / total 198 <snip> drwxr-xr-x 4 root root 4096 Dec 3 14:18 opt drwxr-xr-x 2 root ... (2 Replies)
Discussion started by: edstevens
2 Replies

10. Solaris

SunOS confusing root directory and user home directory

Hello, I've just started using a Solaris machine with SunOS 5.10. After the machine is turned on, I open a Console window and at the prompt, if I execute a pwd command, it tells me I'm at my home directory (someone configured "myuser" as default user after init). ... (2 Replies)
Discussion started by: egyassun
2 Replies

LEARN ABOUT CENTOS

pam_loginuid

PAM_LOGINUID(8) 						 Linux-PAM Manual						   PAM_LOGINUID(8)

NAME

       pam_loginuid - Record user's login uid to the process attribute

SYNOPSIS

       pam_loginuid.so [require_auditd]

DESCRIPTION

       The pam_loginuid module sets the loginuid process attribute for the process that was authenticated. This is necessary for applications to
       be correctly audited. This PAM module should only be used for entry point applications like: login, sshd, gdm, vsftpd, crond and atd. There
       are probably other entry point applications besides these. You should not use it for applications like sudo or su as that defeats the
       purpose by changing the loginuid to the account they just switched to.

OPTIONS

       require_auditd
	   This option, when given, will cause this module to query the audit daemon status and deny logins if it is not running.

MODULE TYPES PROVIDED

       Only the session module type is provided.

RETURN VALUES

       PAM_SESSION_ERR
	   An error occurred during session management.

EXAMPLES

	   #%PAM-1.0
	   auth       required	   pam_unix.so
	   auth       required	   pam_nologin.so
	   account    required	   pam_unix.so
	   password   required	   pam_unix.so
	   session    required	   pam_unix.so
	   session    required	   pam_loginuid.so

SEE ALSO

       pam.conf(5), pam.d(5), pam(8), auditctl(8), auditd(8)

AUTHOR

       pam_loginuid was written by Steve Grubb <sgrubb@redhat.com>

Linux-PAM Manual						    09/19/2013							   PAM_LOGINUID(8)
All times are GMT -4. The time now is 08:35 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy