topic Re: Restricted access in Operating System - HP-UX

Restricted access

Tony500 — Fri, 26 Apr 2002 17:57:50 GMT

I know that I can restrict a user's access with 'rsh' but that keeps the user from being able to change directories (even to directories created under user's home directory apparently). Is there a way to restrict a user to a certain range of directories (including subdirectories of user's home dir)?

Re: Restricted access

Pete Randall — Fri, 26 Apr 2002 18:01:26 GMT

Hi,

You'd have to use permissions I think. Make the user a member of a distinct group and very carefully set group permissions on all the directories you want to exclude him from. Sounds like a lot of trouble to me.

Pete

Re: Restricted access

hari jayaram_1 — Fri, 26 Apr 2002 18:02:15 GMT

hi,

Have you tried using ACL ?

Rgds

Hari

Re: Restricted access

hpuxrox — Fri, 26 Apr 2002 18:03:43 GMT

Do a chroot on them and they will be restricted to the "root" that you give them.

man chroot

Re: Restricted access

Tony500 — Fri, 26 Apr 2002 18:05:58 GMT

Wow that does sound like a lot of trouble! Still, some user's are naturally curious and wander into areas they probably shouldn't. There are one or two users on my system who fall into this category. Unfortunately, this is a mission critical machine and I can't allow them to create a disaster while trying to self teach themselves.

Re: Restricted access

Tony500 — Fri, 26 Apr 2002 18:13:12 GMT

Hari,
I've seen the term ACL mentioned here lately, but I really don't know much about it. What does it do and how do you use it?

Re: Restricted access

Pete Randall — Fri, 26 Apr 2002 18:15:34 GMT

Actually, a lot of it should be easy - all you want to do is remove write permissions. For example, nobody but root should be writing in /opt - do a "chmod -R a-w /opt" and they can't mess with it.

Pete

Re: Restricted access

Tony500 — Fri, 26 Apr 2002 18:43:00 GMT

Thanks Pete, I think that might be my best option. The only thing I worry about is: What about the 'Bang' (:wq!) Will they still be able to manually edit a file and save it with ":wq!" ?

Re: Restricted access

hari jayaram_1 — Fri, 26 Apr 2002 19:22:26 GMT

Tony,

Here is a link for acl

http://www.docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90693/B2355-90693_top.html&con=/hpux/onlinedocs/B2355-90693/00/00/10-con.html&toc=/hpux/onlinedocs/B2355-90693/00/00/10-toc.html&searchterms=acl&queryid=20020426-132749

ACL is useful if you have JFS. It is also tricky and complicated unless you have a use for it.

Please let me know if you require any further info.

Re: Restricted access

Pete Randall — Sat, 27 Apr 2002 14:14:30 GMT

Tony,

No, without write permission on either the directory or the file, no-one but the owner or root should be able to write to the file, bang or not.

Good luck,
Pete