User with read-only to entire filesystem


 
Thread Tools Search this Thread
Operating Systems Solaris User with read-only to entire filesystem
# 1  
Old 01-26-2018
User with read-only to entire filesystem

Is this even possible?

Its a request for external auditors to login remotely.
# 2  
Old 01-26-2018
Hmmmm........this is not easy to do but not too difficult either. Let me elaborate.

There's no standard way of achieving this with access rights, group rights, or different user setup.

What version of Solaris are we talking?

However, you can create a special read-only shell, a new mountpoint lower in the filesystem, and remount '/' on that mountpoint. A specially created userid can then login and be given a read-only shell and access to '/' remounted as read-only.

Look at this:
LNXHC: HowTo Create a read-only user (Solaris 10) - BigAdmin - wikis.sun.com

It depends whether you want to go to this amount of modification to achieve it.
# 3  
Old 01-26-2018
Another way might be to NFS mount the filesystem to a server you don't care about and give them access to that. You can set the share and/or the mount options to be read-only.

If you don't have a spare server, could you share/mount it back to yourself read-only and chroot the user account to that mount point. You need to make sure that they can't escape out again though without logging off. You might get away with exec chroot /read-only-fs in their normal .profile, but you'd need to test it. I haven't done this, it's just a theory.


I hope that this helps,
Robin
# 4  
Old 02-06-2018
Quote:
Originally Posted by rbatte1
Another way might be to NFS mount the filesystem to a server you don't care about and give them access to that. You can set the share and/or the mount options to be read-only.

If you don't have a spare server, could you share/mount it back to yourself read-only and chroot the user account to that mount point. You need to make sure that they can't escape out again though without logging off. You might get away with exec chroot /read-only-fs in their normal .profile, but you'd need to test it. I haven't done this, it's just a theory.


I hope that this helps,
Robin
Sounds like a good idea. Remind me - if I share/mount it back to the other server (as RO) does it give me read permission to every file?
# 5  
Old 02-06-2018
Yes, If you share the share with root permissions.
I haven't actually tried to export the entire filesystem hierarchy via NFS...

Even with ro permission, the user will see all the files on the system, including password hashes from operating system files, host keys etc.

This should not be done as it compromises system security in so many ways ...

Auditors should not have or require access to those important security files.
If required, you should provide those files with hashes replaced/blanked.

Only if the requirement of audit is to compromise the trust of the server and its users.

Hope that helps
Regards
Peasant.
This User Gave Thanks to Peasant For This Post:
# 6  
Old 02-08-2018
This sounds like a good use-case for a zone. You can mount the required filesystem(s) read-only in the zone, and create normal user(s) for the auditor(s) in just that zone.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Solaris 10 - Filesystem become read only suddenly

Hi, i just started few days ago to face the problem when the whole system is getting freeze. By freeze i mean: * server is reachable (via network) * i cannot connect to server via SSH or Telnet(when try to use SSH or telnet it will find server, try to connect, but it freeze after... (4 Replies)
Discussion started by: frankosun
4 Replies

2. Shell Programming and Scripting

Bash script read specific value from files of an entire folder

Hello, I heva a problem creating a script that read specifc value from all the files of an entire folder I have a number of email files into a directory and i need to extrect from each file 2 specific values. After that i have to put them into a new file that looks like that: To: value1 ... (1 Reply)
Discussion started by: ahmenty
1 Replies

3. UNIX for Dummies Questions & Answers

Change the entire filesystem

Hi everyone, I've installed RedHat 5 enterprise into a VirtualBox, but some how i can't eve create a single file, cause appear u message like this: Read-only filesystem. i'm logged as root. Any idea (6 Replies)
Discussion started by: Newer
6 Replies

4. Shell Programming and Scripting

Help with Bash piped while-read and a read user input at the same time

Hi I am new to writing script and want to use a Bash Piped while-read and read from user input. if something happens on server.log then do while loop or if something happend on user input then do while loop. Pseudocode something like: tail -n 3 -f server.log | while read serverline || read... (8 Replies)
Discussion started by: MyMorris
8 Replies

5. AIX

Mount Filesystem in AIX Unable to read /etc/filesystem

Dear all, We are facing prolem when we are going to mount AIX filesystem, the system returned the following error 0506-307The AFopen call failed : A file or directory in the path name does not exist. But when we ls filesystems in the /etc/ directory it show -rw-r--r-- 0 root ... (2 Replies)
Discussion started by: m_raheelahmed
2 Replies

6. UNIX for Dummies Questions & Answers

How to read entire output from a file?

Hello- I am trying to view a file which is quite large. However, whenever I do 'cat (file name)' it shows me just the half.. I am using Putty to access my server. Also, is it possible to edit a file from a unix system on a 'Gedit for Windows" text editor? Thanks (7 Replies)
Discussion started by: DallasT
7 Replies

7. Shell Programming and Scripting

Accessing entire line during "while read"

I am using the time-honored construct "while read field1 field2 field3 ; do" to pull delimited fields from lines of data in a file, but there are a few places within the loop where I need to manipulate the entire, unsplit line of data. Does "while read" keep each entire record/line somewhere prior... (2 Replies)
Discussion started by: fitzwilliam
2 Replies

8. Shell Programming and Scripting

How to Read the entire file using while loop

Guys, I am trying to read the whole file using while loop but when i run the ssh part of the script it reads only the first line and exit after that. There are in total 134 lines in the file, but when the output is redirected, it does only for one line and comes to command prompt. pls help..... (11 Replies)
Discussion started by: sdosanjh
11 Replies

9. UNIX for Advanced & Expert Users

Read the entire output fired by ps command

Actually I want to display the entire output fired by ps command. My output gets trucated after 80 chars. Thus, i am not able to see the entire command running when i give a ps -eaf .... Does anyone know how do i display the entire output fired by ps command .. (i.e the command along with... (5 Replies)
Discussion started by: vinithepoo
5 Replies

10. UNIX for Dummies Questions & Answers

/ filesystem is mounted read only

how do you fsck the / filesystem? I know it does it automatically the next time I boot up following a switch on the wall shutdown but is there a flad somewhere that forces this on next boot up? Thanks (2 Replies)
Discussion started by: DGK
2 Replies
Login or Register to Ask a Question