How to limit access authorization

[Liang-hong Ye]

I created an user and created a file system for him, now I want to limit his authoriztion.

1.this user just can use the directory which assign to him.
2.this user should cannot read, write other directories.
3.This user should can use the most of the Unix commands under this directory.

Anyone can help me? thanks.

[James R. Ferguson · Accepted solution]

Hi:

I would consider setting up the user in a restricted shell (/usr/bin/rsh). From the man pages for 'sh-posix' note:

/quote/

rsh is used to set up login names and execution environments where capabilities are more controlled than those of the standard shell. The actions of rsh are identical to those of sh, except that the following are forbidden:

+ Changing directory (see the cd special command and cd(1))

+ Setting the value of SHELL, ENV, or PATH

+ Specifying path or command names containing /

+ Redirecting output (>, >|, <>, and >>)

The system administrator often sets up a directory of commands (usually /usr/rbin) that can be safely invoked by rsh.

/end_quote/

...JRF...

[Michael Tully]

Hi,
I would suggest setting up these type of users
into a resticted shell or rsh as more commonly
known. Once set up these users are more
tightly controlled within their own environment,which means they are basically only allowed to be within the confines of their own home directory.

A look at the man page 'sh-posix' is definitely
worth it. If there programs that need to be run
by these type of users, they are usually placed
in a directory called /usr/rbin. An example of one of these is 'red' or a restricted 'ed'

HTH
Michael

[Mr LAMARTA]

hello,
As Michael and James said dont forget to set up /usr/rbin otherwise your efforts to restrict access could be broken by a simple invocation of ksh !!!

[Liang-hong Ye]

Thanks for your help.

I've tried to use rsh before but it also has some problems.

1. The user can use such as 'ls ..' to list other directories. What I want is he cannot view anything in other directories.
2. The user cannot 'cd 'to the subdirectories which created by himself.

How to resolve these problems?

[Michael Tully]

Hi,

Only other thing I readily think of is to have the user(s) in a captive menu, where you would have a selection where they can view their sub-directory, then once they hit another key, returns them to back into the menu again. If you cannot get one started let the forum know, there should be a lot of them around. I can give an example when I am in my office again tomorrow (Sydney time).

HTH
Michael

[Jacob_3]

We have almost the same problem. We also want to prevent the user from some commands like ftp and telnet.

We found out that the best way is using CA eTrust AccessControl, but it is expensive (~5K per server) and not very easy to work with. But it does the work really good.

[Brian Markus]

Under linux, and Solaris you can make something called a CAGED environment. Linking the binarys etc. they have almost thier own unix box.
/home/baduser/bin
/home/baduser/etc
/home/baduser/opt
all of those . They see /home/baduser as / and can't get any farther. I've never tried it under HP-UX, I'm not sure if it's possible. That might be the way to go if it's possible.

Hope you can find something on it.

Good luck

Brian