No rights to create a file called cat,ll

[zxcv]

Hi ,

In my envt a user must not be able to create files such as cat , ll , mv  which are standard unix commands.

How can i achieve this ?

O.S hpux 11iv2

[Dennis Handly]

What can the users do?  To prevent them from creating files by this name, you have to disallow mv, chmod, touch, cat, cp, editors, etc.

[zxcv]

Hi Dennis ,

how do i disallow them ??

[Doug O'Leary]

Hey;

To my knowledge, you really can't prevent this.  If you distrust your users to this point, then they shouldn't have access to the system.  

Another way of looking at this: you're trying to fix something that's not a problem.  Even if a user does create a script that has the same name as a normal UNIX utility, the normal utilities will show up in the path statement *before* anything a normal user can create assuming you don't have write access to binary directories for users other than root.  Root and other applicaiton administration accounts need to be limited access: only a specific (small) number of people can access them.

So, even if Billy Blackhat does create a 'cat' script, none of the administrative accounts will run it.  However, what if Billy Blackhat has access to a privileged account?  The right answer still isn't the prohibition that you're looking for.  The right answer is some type of change management software: tripwire, OSSEC, soemthing along those lines.  cfengine will also do the trick, but it'd be a bit more work, I'd imagine.

Doug O'Leary

[Dennis Handly]

>how do I disallow them?

Possibly by creating wrappers and making sure that PATH can't be changed.  You probably need a restricted shell.

Or if there is a single application you want users to run, you can set up a menu in their .profile so that it just

runs that application.

>you really can't prevent this.  If you distrust your users to this point, then they shouldn't have access to the system.

Right.

>Even if a user does create a script that has the same name as a normal UNIX utility, the normal utilities will show up in the path statement *before* anything a normal user can create assuming you don't have write access to binary directories for users other than root.

That's not true for users.  And better not be true for root (. in PATH).  (If that's what you are trying to protect.)

[Torsten.]

This is exactly the reason why you should never have "." in PATH (aspecially as root).

[Doug O'Leary]

>>This is exactly the reason why you should never have "." in PATH (aspecially as root).

And non-world writable binaries/bin directories

and limited access to root and other administrative accounts

and.. and..

I was really trying to avoid drafting a whole UNIX security white paper; however, you and Dennis very accurately (and correctly) pointed out the drawback with my approach.

To the original poster: There is a very large amount of tasks that should be done to secure a UNIX box; even more than can be done, but doesn't necessarily have to be done.  What you're asking, even if it is possible, will cause more problems than it will fix.

Hope that helps.

Doug O'Leary

[Chirag Parikh]

Hi,

HP UNIX Containers is the product which might help you for the configuration which you are looking for. 

Regards,

Chirag Parikh