Restricted user


 
Thread Tools Search this Thread
Special Forums Cybersecurity Restricted user
# 1  
Old 04-18-2002
Restricted user

A few of the other employees here need to learn "vi" in order to use crontab to schedule / unschedule jobs on one of our production servers. I tried to set up a login on one of my Linux boxes for them to use "vimtutor", but scrapped it and decided to try for something more secure, since there are expect scripts on this box to aid them in some jobs on other servers, and the passwords for the various accounts / services should not be known. I am the only person with a usable interactive account on this machine. Here are the steps I took:
In /etc/lilo.conf, I added "password=*****" and "restricted" lines, so that no one could bring the box up in single-user without a password. It does, however still have a floppy and cdrom drive that could bring it up - that is one of major weaknesses now, although there are only 5 or 6 people who could get physical access to it anyways. Let's pray that works out OK Smilie
I added a user (named tutor). Here is the /etc/passwd entry:
tutor:x:1009:99:vimtutor login:/home/tutor:/bin/rbash
GID 99 is "nogroup".

Here is the contents of the /home/tutor directory:
Code:
/home/tutor$ ls -lia
total 24
 163281 drwxrwx---   3 tutor    admin        4096 Apr 18 03:01 ./
 881283 drwxrwxr-x   9 root     root         4096 Apr 17 22:02 ../
 163287 -rw-r-----   1 tutor    admin           1 Apr 18 02:52 .bash_history
 163288 -r--rw----   2 tutor    admin         457 Apr 18 03:05 .bash_profile
 163288 -r--rw----   2 tutor    admin         457 Apr 18 03:05 .bashrc
 163282 d-wxrwx---   2 tutor    admin        4096 Apr 18 03:09 tmp/
/home/tutor$ lsattr -a
-------- ./.
-------- ./..
-----a-- ./.bash_history
----i--- ./.bash_profile
-------- ./tmp
----i--- ./.bashrc

The permissions allow me (I am the admin group) to watch and modify files in the directory, but disallows editing/truncating (although it allows appending) of the .bash_history file, and makes the .bash_profile/.bashrc (they are the hardlinked) immutable. Even their own tmp dir is not listable, but more on that later.

The login shell, rbash, is a restricted bash environment that will not let you execute anything with a "/" in the path from the command line (it has to be in your path), and disallows the "cd" command. It also keeps many variables used by bash read-only, locks down the hash, set, command, enable, exec, ., and enable command, and disables the use of re-directors ( > , for example).
A common problem with restricted shells is that you can typically just type "sh" to execute a new shell and effectively "break out". To prevent this, I simply set the $PATH to null... there should be no interaction with the shell anyways. rbash will, however, allow you to specify applications by full path in the startup scripts. Check out the .bash_profile/.bashrc:
Code:
PATH=""
umask 007

export PATH

# Need this so vi works with 
# stupid Windows telnet... who the hell uses "ansi" anyways?
if [ "$TERM" = "ansi" ]; then export TERM=vt100; /usr/X11R6/bin/resize; fi

tutorial () {
TUTORCOPY=/home/tutor/tmp/tutor$$
export TUTORCOPY
/usr/bin/rvim -u NONE -c 'e $VIMRUNTIME/tutor/tutor' -c 'w! $TUTORCOPY' -c 'q'
/usr/bin/rvim -u NONE -c "set nocp" $TUTORCOPY
/bin/rm -f $TUTORCOPY
}
tutorial; /usr/bin/clear; exit

I've actually set it up to run the "vimtutor" program implemented in the .bash* rather than in a seperate script - as it exits, it should clear the screen and exit the shell. Also, vim is run in restricted mode, so no shell escapes are allowed, and it ignores the ^Z sequence to background it. It should technically not allow anyone out of vim.

I figure that nothing's perfect, so to mitigate the risk of a possible "escape", I made sure that key files (.b* and tmp/) are not able to be manipulated by the user. Even if they got "out", they couldn't even "ls", although "echo * .[a-z]*" would still give them a little info...

At one point, I was going to allow limited command access to the shell via using soft-linked commands in their own personal bin/ directory with the PATH=/home/tutor/bin . I realized very quickly though, that they could fuddle their way around a little, like using cp or cat to grap a copy of /bin/sh. I suppose I could have made bin/ non-writeable by them, but once you lock it down as much as I would have, there's no point in shell access, right? Let's just save ourselves the troubles and give shell access on a per-user basis (possibly set up a large chroot'd area for restricted users).

I think I have covered all (or at least most) of my steps...

Now the challenge! Can anyone find a way to break out?
I want this to be as tight as it reasonably can without removing the functionality altogether...

Look forward to your feedback!

Last edited by LivinFree; 04-18-2002 at 08:25 AM..
# 2  
Old 04-18-2002
The shells are programming languages with considerable power, enough to reproduce most unix commands. This is why the restricted shells fail.

Code:
xxls() { while (($#)) ; do echo "$1" ; shift ; done ; }
xxcat() { while read l ; do echo "$1" ; done < $1 ; }
xxls /etc/pass*
xxcat /etc/passwd

That's already a good start and it's only the very tip of the iceberg.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Debian

Create restricted user for programs

want to create a user account for each of the key programs installed on my debian server. For example, for the following programs: Tomcat Nginx Supervisor PostgreSQL This seems to be recommended based on my reading online. However, I want to restrict these user accounts as much as possible,... (3 Replies)
Discussion started by: Spadez
3 Replies

2. AIX

Restricted user

Hello everyone I need to create a restricted user or a special user. Here is what I need. I have this path next to profiles I have server1, server2, server3....... The user that I have to create I need that he can move between server1. server2, server3 because in every one have logs... (1 Reply)
Discussion started by: lo-lp-kl
1 Replies

3. Solaris

create a restricted user

I have solaris 10 os 64 bit. I need to create a restricted user which has the following command to run ls df and du list crontab of root and edit crontab of root also please help (2 Replies)
Discussion started by: reyazan
2 Replies

4. Solaris

Create user with Restricted Space usage

Hi, What is the command or how to create a user with the restricted usage of space on a disk. Also let me know how to change the limit of the space size allotted in future for the same user. ~Vinodh Kumar V M (3 Replies)
Discussion started by: vino_hymi
3 Replies

5. UNIX for Dummies Questions & Answers

User should be restricted moving a folder

Hi All , Some of the users should be restricted using the MV commands on some of the standard folders. We had an issue the other day like from the standard folder structure which was set up one of the user has moved a folder to a different location and the jobs failed as the folder was not... (6 Replies)
Discussion started by: perlamohan
6 Replies

6. UNIX for Dummies Questions & Answers

Need to create a restricted user(Centos)

Hi, I am a newbie to Linux and I want to create a user which can only execute network config commands like ifconfig and ping(to check the config). The following is what I did but failed. 1) Created a group called 'netconfig'. 2) added a user named 'user'. 3) added user to the 'netconfig'... (4 Replies)
Discussion started by: ankushpandit
4 Replies

7. AIX

A user with restricted ftp access to a folder

Hi, We have Oracle Database on AIX 5.3 server.We want to give ftp access to a user to a specific folder.He should be able to put and get files from that specific folder only.Moreover he should not be able to cd to any other filesystems also along with root directory. Please note that as per... (1 Reply)
Discussion started by: dwiravi
1 Replies

8. Shell Programming and Scripting

To provide restricted access to certain user's on linux box

Hi, I need to provide execute access to certain users and not to all users For ex: if ther is a file /home/august/aug.sh. and there are user's like jan,feb,mar,april,May and jan is the owner of that box. I need to provide execute access to feb and mar only. I also know the root pwd for... (3 Replies)
Discussion started by: Ashok_oct22
3 Replies

9. Solaris

How to set restricted user by rksh? Cannot use Perl module DBD::Oracle

Hi, all, I need to add a user to our system in order to let him use Oracle and Perl. We want him to remain in his home directory and have no access to our data and other users' files. I created a separate group for this user, and set his shell to rksh when I created his account, by which he... (2 Replies)
Discussion started by: alanlh
2 Replies

10. UNIX for Advanced & Expert Users

HP-UX Restricted SAM

I am having trouble getting restricted SAM to work by allocating Privileges to a "group". I can make it work by allocaing to the userid's, but would preferre to use the "group" option. Running B.11.11 Tried the following.... 1) Created a user group in /etc/group first 2) Used the... (1 Reply)
Discussion started by: Andrek
1 Replies
Login or Register to Ask a Question