topic Restricing users to certain directories in Operating System - HP-UX

Restricing users to certain directories

Kevin Moore_2 — Wed, 23 May 2001 12:23:34 GMT

Hi,

We have a number of users to log in to our HP-UX 11.00 systems to analyze log files. They only need to be able to read (not edit) the files in one directory. Can this be forced?
I was thinking of setting there home directory to the logdir, and then somehow disabling the cd command.
Does anyone know how to do this or maybe have better ideas on how to accomplish.

Many thanks,
Kevin

Re: Restricing users to certain directories

Stefan Farrelly — Wed, 23 May 2001 12:26:52 GMT

use the restricted shell (rsh), this disables the cd command completely. See man page on sh-posix for section on rsh

Re: Restricing users to certain directories

Thierry Poels_1 — Wed, 23 May 2001 12:37:35 GMT

yep, rsh is nice, but if the user is able to start another shell, then he's back free to go wherever he wants.
regards,
Thierry.

Re: Restricing users to certain directories

Kevin Moore_2 — Wed, 23 May 2001 12:41:52 GMT

Thanks Stefan,

rsh is a good start, but the users have a fair idea of whats going around. They can still view files using more /whatever/file.xxx
It would be an impossible job to try and change permissions on all the files.
What I am looking to do exactly, is let them view files in one directory, and nowhere else. I don't even want them to be able to ls
I know it's probably a huge task, just looking for a place to start.
I was originally thinking of using FMLI, but my HP TAM says it is not available on HP-UX

Kevin

Re: Restricing users to certain directories

Stefan Farrelly — Wed, 23 May 2001 12:44:54 GMT

Instead of using rsh you can accomplish what you want simply with permissions. With the directory and files set to read only there is no way someone will be able to modify them.

Re: Restricing users to certain directories

David Lodge — Wed, 23 May 2001 16:11:27 GMT

None of the above solutions are perfect.

The only real way of doing this is to force the user into a restricted chrooted environment.

This can be done coding a login shell which chroot's the user to the area.

Or, the easiest way is to do it via FTP and ftpaccess - this means the users will only be able to FTP in, but you can restrict them easily.

FOr more details on this check the ftpaccess man page

Re: Restricing users to certain directories

Mark Fenton — Thu, 24 May 2001 00:03:29 GMT

Could you achieve your goal with their profile set to root to the log directory and then the shell they receive be the rsh? something like a passwd entry of

usera:x:uid:gid:comment:/logdir:/usr/bin/rsh

presupposes you are not using NIS (or NIS+) if there are multiple UNIX boxes in the domain....

Re: Restricing users to certain directories

Kevin Moore_2 — Thu, 24 May 2001 09:40:36 GMT

Thanks a million David,

Your suggestion on chroot definetly looks like the right way to go. Don't suppose you know where there is good documentation on this, or an example of what I am try to do, as I haven't been able to find any.

Thanks again for the great idea
Kevin