topic Re: Secure User in Operating System - HP-UX

Secure User

Stephen Young_1 — Fri, 01 Mar 2002 10:08:30 GMT

Hi,

I have created a standard unix user with ksh shell.
Is there a way of only allowing the user to create files in his home directory ?
I have tried using /home/user/./ but doesn't work

Cheers

Re: Secure User

Steven Sim Kok Leong — Fri, 01 Mar 2002 10:13:53 GMT

Hi,

One way is to use chroot, so that the virtual root is /home/user

The other way is to use restricted sam, force the user to run sam upon login in the /etc/profile or /etc/csh.login within traps.

In your restricted sam, configure a script that prompts the user for a file to be created. This script sanitizes the input and removes any pathname attached ie. only taking the filename.

In this way, the user can only create files in his home directory. You can also restrict the commands this user can perform using restricted sam.

Hope this helps. Regards.

Steven Sim Kok Leong

Re: Secure User

Steven Sim Kok Leong — Fri, 01 Mar 2002 10:27:47 GMT

Hi,

Strictly speaking, I don't think you want to restrict the user to just only write files in /home/user.

There are a lot of programs that require temporary files to be written especially in /tmp and /var/tmp (such as vi).

If you remove the write access, then such programs are likely to encounter difficulties in running. You may have to perform quite a bit of reconfiguration as a result.

Hope this helps. Regards.

Steven Sim Kok Leong