How can I restrict users to access their own HOME directories ONLY?

[yyghp]

I want to restrict users to access their own HOME direcotories, for example, user "tom" can only access /home/tom. I don't want to change all other files in other direcotories to be "xx0" ( like 770, 660, 550, ... ). That is, I want to restrict the users to stay in their own HOME directories.
How?
Thanks!

[Alessandro Pilati]

It could be possible chrooting user's homedir...

Regards,
Alex

[Raj D.]

Hi Yyghp ,

You need to setup restricted shell for that user , with /usr/bin/rsh

You may have a look at this link:

http://newfdawg.com/SHP-RestShell.htm

Cheers ,
Raj.

[Alessandro Pilati]

Or also use the retricted shell,
check these links:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x4b278f960573d6
11abdb0090277a778c,00.html

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x6b165fe8b250d
71190080090279cd0f9,00.html

Regards,
Alex

[Rick Garland]

Can use the restricted shell or can use the chroot configuration. Either way will work.

The rsh (restricted shell) is easier

[Alessandro Pilati]

Oops sorry Raj,
you are too fast for a simple Graduate ;-)

[yyghp]

If I use restrict shell, like /usr/bin/rksh, I have two problems:

1. I can't use that user to ftp to his own home directory, which is a must:

530 User transfr access denied...

2. Although the user can't use "cd" after login, but he/she can list other directories and files, and read/vi them with full path...

Thanks!

[Victor BERRIDGE]

Hi,

>1. I can't use that user to ftp to his own home directory, which is a must:

Are you sure you put rksh in /etc/shells?
cta:/home/rgu $ ftp draco
Connected to draco.
220 draco FTP server (Version 1.1.214.4 Mon Feb 15 08:48:46 GMT 1999) ready.
Name (draco:vbe): rgu
331 Password required for rgu.
Password:
230 User rgu logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> bye
221 Goodbye.
cta:/home/rgu $ echo $SHELL
/usr/bin/rksh
cta:/home/rgu $

>2. Although the user can't use "cd" after login, but he/she can list other directories and files, and read/vi them with full path...

Quite true! But this is only because you let that account do so...
From the mans:
rksh Only
rksh is used to set up login names and execution environments where
capabilities are more controlled than those of the standard shell.
The actions of rksh are identical to those of ksh, except that the
following are forbidden:

+ Changing directory (see cd(1))
+ Setting the value of SHELL, ENV, or PATH
+ Specifying path or command names containing /
+ Redirecting output (>, >|, <>, and >>)

The restrictions above are enforced after the .profile and ENV files
are interpreted.

When a command to be executed is found to be a shell procedure, rksh
invokes ksh to execute it. Thus, the end-user is provided with shell
procedures accessible to the full power of the standard shell, while
being restricted to a limited menu of commands. This scheme assumes
that the end-user does not have write and execute permissions in the
same directory.

When a shell procedure is invoked from rksh, the shell interpreter
specified with the #! magic inherits all the restricted features of
rksh. So, the shell procedures written for execution under rksh with
the intent of utilizing the full power of the standard shell should
not specify an interpreter with #!.

These rules effectively give the writer of the .profile file complete
control over user actions, by performing guaranteed set-up actions and
leaving the user in an appropriate directory (probably not the login
directory).

The system administrator often sets up a directory of commands
(usually /usr/rbin) that can be safely invoked by rksh. HP-UX systems
provide a restricted editor red (see ed(1)), suitable for restricted
users.

So start by customyzing the .profile!
I believe you have all the needed information to continue now...


Good luck and
All the best
Victor

[yyghp]

Thanks a lot Victor!
But I still don't understand what I should do for the 2nd problem, how can I prevent users to list/read files outside their home directories, with .profile?
Could you please give me more detail about this?
Thanks again!

[Vibhor Kumar Agarwal]

Try this option, couldn't give the script but will give the logic.

Make a alias of cd like:

alias cd new_cd.sh

new_cd.sh
if ( "no. or arguments" = 0 )
then usage "..."
else
if ( $1 contains $HOME as a substring )
then cd $1
else cd $HOME
fi

I think this will work.
By the way what is chrooting guys?

[yyghp]

Hi Victor,

According to my question 1 above, about the ftp, what I did was:

(1). vi /etc/passwd, change shell from "/usr/bin/ksh" to "/usr/bin/rksh":
transfr:*:153:240:French Translator User,,,:/home/transfr:/usr/bin/rksh
(2). vi /etc/shells, add:
/usr/bin/rksh
Now, I can login via FTP, but I can "cd" back to the user's parent folders! Why?

ftp> cd ..
250 CWD command successful.
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for file list.
...

It seems the restricted shell didn't work at all...
Please help, thanks!

[yyghp]

Why right after I changed "/usr/bin/ksh" to "/usr/bin/rksh" in "/etc/passwd", the ftp denied the user ?

ftp> user transfr
530 User transfr access denied...
Login failed.

Thanks!

[yyghp]

any suggestion about my issue?
thanks!

[morganelan]

See this link:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=70367

[Victor BERRIDGE]

Hi,
I lack of time at the moment...
So what is most important now:
understanding what is going on or try to find an solution that works?
If second to make it short:
What are you tring to achieve?
That does that user need to accomplish his tasks?

All the best
Victor

[yyghp]

I am eager to know how I can keep FTP working after I enable restricted shell by changing "/etc/passwd" with "rksh"...

Thanks!