topic Linux security in Operating System - Linux

Linux security

M.S — Wed, 20 Aug 2008 12:53:26 GMT

Hi All,

How can we restrict a user when he access a linux machine can't go to any folder other than the one that he access to it upon login, also restrict him to use just specific commands and can't use anything else.

Appreciate any help here.

Thanks,

Re: Linux security

Ivan Krastev — Wed, 20 Aug 2008 13:00:22 GMT

Use restricted shell - http://felipecruz.com/blog_restricte-linux-users-to-their-home.php

regards,
ivan

Re: Linux security

M.S — Wed, 20 Aug 2008 13:32:42 GMT

Hi Ivan,

I'm using rhel5, and i can't find bash2 package. Is it still in use.

Regards,

Re: Linux security

Ivan Krastev — Wed, 20 Aug 2008 13:35:32 GMT

See RH document - just copy bash to rbash - http://kbase.redhat.com/faq/FAQ_35_3940.shtm

regards,
ivan

Re: Linux security

M.S — Wed, 20 Aug 2008 13:45:36 GMT

Hi Ivan,

Thx for your help here, i still have an issue where i want to restrict this to use just specific command. Like just use ping and traceroute and nothing else at all (he can't create read write and do anything other than the predifined commands)

Is there a way to do that

Thx

Re: Linux security

Steven E. Protter — Wed, 20 Aug 2008 21:26:26 GMT

Shalom,

Try chroot

http://www.howtoforge.com/chrooted_ssh_howto_debian

Number of good solutions.

Not easy but air tight secure.

SEP

Re: Linux security

Srimalik — Thu, 21 Aug 2008 05:27:02 GMT

What about modifying you system to serve the purpose.

Create two new groups
1) restricted
2) free

restricted: to which all the user whom you want to restrict will belong.

free: all the free and happy users will belong

then create a directory say /rec_bin(or whatever u want to call it) and copy all the commands(to be used by restricted users) from /usr/bin /bin to this directory. make this directory readable and executable by restricted group.

Change the permission of /bin /usr/bin /sbin etc etc. to disallow anybody except the owner and the free group.

In this way the restricted users wont' be able to access all the commands on the system but they will be able to run the commands kept in /rec_bin

Sri

Re: Linux security

Alexander Chuzhoy — Thu, 21 Aug 2008 06:47:46 GMT

Ivan,
Try to run bash from the "rbash" environment. On centos5, users that are logged into rbash are able to switch to bash (where "cd" is not restricted) simply by typing "bash".
I'm not sure whether it was designed that way on purpose...

Re: Linux security

Heironimus — Thu, 21 Aug 2008 15:14:46 GMT

Just changing the shell to rbash isn't sufficient because you need to control what's in $PATH. At a minimum, you need:

1. restricted shell (like rbash)
2. directory with symlinks to permitted commands
3. read-only custom login script to set PATH to only contain that directory of symlinks
4. read-only home directory