How to prevent a users from using a specific command

[Mouad_1]

How I can prohibit the use of a command by a user (for example tar) ?

[Pete Randall · Accepted solution]

Put an alias for tar in the user's .profile that points to a null command or write a wrapper script for tar that checks the userid before invoking the real tar.


Pete

[Mouad_1]

Thanks a lot Pete.
I put
alias tar=''
in the .profile of the users
It works fine.

[Pete Randall]

The only problem with either approach is that a knowledgeable user can work around them by invoking the real tar with the full path name of the command. To be really secure, you would actually have to hide the real command somewhere else.


Pete

[Mouad_1]

You're right, but inserting these 2 line :
alias /sbin/tar='echo "not allowed : tar"'
alias tar='echo "not allowed : tar"'
into the .profile will do the jobs .

[Muthukumar_5]

You can control /sbin/tar execution by putting as,

alias /sbin/tar='echo "Not allowed : tar"'

# alias /sbin/tar='echo "not allowed : tar"'
sh: /sbin/tar=echo "not allowed : tar": Invalid alias name.

hth.

[Muthukumar_5]

Sorry. You can cannot control by putting /sbin/tar as an alias.

You can try with another way by writing a shell wrapper as,

mv /sbin/tar /sbin/tar.org

#!/bin/ksh

if [[ $LOGNAME = "" ]]
then
echo "Permission Denied"
exit 1
else
/sbin/tar.org $@
fi

exit 0
#

save this file as /sbin/tar with bin:bin -r-xr-xr-x permission.

hth.

[Mouad_1]

I've tried making alias for both command and its absolute path and it works !? :
$ tar cvf m.tar file*
not allowed : tar cvf m.tar file1 file2
$ /sbin/tar cvf m.tar file*
not allowed : tar cvf m.tar file1 file2

Anyway, reWriting the command with a script as you said seem to be a good idea. Thanks

[Roland Piette]

Hi all

Nice to work with aliases but ..... it doesn't work in subshell.

I try this following under HP-UX 11.0 & 11i :

alias ls="ls -l"
ls
ksh
ls

The second ls doesn't give the same output !

I try also -x option in alias command ... same effect.

This solution is only valid in the current shell.

Best regards.
Roland

[Ralph Grothe]

Maybe a bit far fetched,
but to really restrict a user and hinder him from issueing certain commands you would need to capture his login in a chroot or jail environment.
Another approach is followed by concepts like SELinux or role based access control (aka RBAC)
If you search www or knoledgebase on these topics with respect to HPUX I'm sure will find many howtos.

[Amit Agarwal_1]

Try setting ACL (access control list) for the binary. You can use setacl and getacl commamnds for the same. Please see manpage for more info.