topic Re: restricted user in Operating System - HP-UX

restricted user

Muhammad Ahmad — Tue, 10 Feb 2009 08:09:25 GMT

Hi,

I would like to create a user with the following access rights:

1. the user can't live outside his home directory structure
2. ordinary user can access his home directory structure

Thanks in advance.
-Br
-Ahmad

Re: restricted user

Steven E. Protter — Tue, 10 Feb 2009 08:32:09 GMT

Shalom,

Using the restricted shell (rsh) will accomplish this goal.

You might also consider if you use ssh of setting this user up as a chroot user.

http://docs.hp.com/en/5992-3387/ch05s06.html

SEP

Re: restricted user

Ganesan R — Tue, 10 Feb 2009 08:42:28 GMT

Hi Muhammad,

You need to configure the user with chroot environment. Configuring chroot manually needs lot of work. HP has provided a script to configure chroot simply.

You need to use the script /opt/ssh/ssh_chroot_setup.sh. This script will create a user and configure that user with chroot environment.

Also read /opt/ssh/README.hp . It will give you exact steps.

Re: restricted user

bright image — Tue, 10 Feb 2009 09:18:07 GMT

If this is an ftp user you may want to look at the following links:

http://newfdawg.com/SHP-FTP-anon.htm

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1264911

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&
;taskId=115&prodSeriesId=3215373&prodTypeId=18964&objectID=c01516983

Re: restricted user

Md. Farhan A Azam — Tue, 10 Feb 2009 13:01:23 GMT

Hi,

just put /./after home directory,

(e.i. user1:4ZCqrSQpm07fk:110:20::/pgapsoft/pegains/CRBT/./:/bin/sh

user will not be able to move from home diectory.

Re: restricted user

Dennis Handly — Tue, 10 Feb 2009 21:29:29 GMT

>Farhan: just put /./after home directory,

I tried this and this doesn't restrict cd with sh/ksh. Where did you here about it?

Re: restricted user

Muhammad Ahmad — Wed, 11 Feb 2009 11:46:39 GMT

Hi All,

Thanks for your time.

Farhan, i agree with Deniss.

Secondly, ftp restricted access is given to that user using "chroot" and it's running fine.

but in this case, only root can access that restricted user's home directory, we need to remove that restriction, so that an ordinary user can also access his home directory sturcture. with in-effect of the existing ftp restricted access for the user.

-Br
Ahmad

Re: restricted user

Ganesan R — Wed, 11 Feb 2009 11:57:32 GMT

Hi Muhammad,

By default write permission will not be given to anyone other then the owner of the home directories. In this case only root and owner can have write access.

If you want to give write access to others as well, use chmod command and give write access to others.

If you are looking something else, clarify in details.

Re: restricted user

Md. Farhan A Azam — Tue, 17 Feb 2009 09:03:24 GMT

Hi Dennis,

Sorry for delay in response, i was out of office from last few weeks.
actually..this will work for FTP user..somehow it was posted....So sorry again.

Thanks Farhan

Re: restricted user

Dennis Handly — Tue, 17 Feb 2009 09:14:49 GMT

>Farhan: this will work for FTP user

Yes, I later saw that for ftpaccess(4).

Re: restricted user

Muhammad Ahmad — Tue, 17 Feb 2009 11:49:04 GMT

Hi Farhan/Dennis,

but in this case, we can't restrict the access of that user on shell through telnet/ssh etc.

-Br
Ahmad

Re: restricted user

Ganesan R — Tue, 17 Feb 2009 13:01:28 GMT

Hi Muhammad,

If you want to restrict the telnet/ssh access then change the shell to /bin/false

Re: restricted user

Md. Farhan A Azam — Wed, 18 Feb 2009 04:39:18 GMT

>Ganeshan R:If you want to restrict the telnet/ssh access then change the shell to /bin/false.

In this scenario user will not be able to login in the server through telnet, as user will not get any shell. i think this will work for ftp.

Re: restricted user

Johnson Punniyalingam — Wed, 18 Feb 2009 10:59:45 GMT

Hi Ahmad,

>>In this scenario user will not be able to login in the server through telnet, as user will not get any shell. i think this will work for ftp.<<

yes ,

But you are looking for "user id" which should be resticted under its own working directory only.?

Can please try below suggestion under (Development Server)

Creat account :- UserA

Edit the /etc/passwd file. Append a "./" to the end of the initial working

userA:cinUTe/NGII4.:505:125::/home/userA/./:/usr/bin/sh

otherwise, You need look for resticted shell (or) jailroot

Thanks,
Johnson