how to restrict rcp to copy from/to a particular directory

[Ramesh Lanka]

Hi Guys
Is it possible to restrict the rcp command such-a-way that it can copy the files only from /to a particular directory?

My requirement is as follows:
1. user 'test' from /home/test directory from 'hp-ux' host will copy some files daily to /home/test of 'aix' host.
Now the Aix system administrator doesnot want the 'test' user from 'hp-ux' to access anyother files otherthan /home/test directory in 'aix' host.

Can anybody give some tips ,how do i do this?

Regds
Ruban

[Steven E. Protter]

The only sure way to do that is to control permissions.

If the rcp user can't access the directory, they can't put files on it.

The rcp command will let the user copy a file from anywhere they have appropriate rights on system a to anywhere they have appropriate rights on system b and vice versa.

If the user has read only rights to /tmp/mystuff then they won't be able to rcp anything to it.

This in my opinion is a scurity/sysadmin issue. The only commands you need are chmod and chown

SEP

[Dario_1]

Ruban:

I am with Steven on this one. I think the only way will be modifying the permissions and/or group.

Regards,

Dario

[Duncan Edmonstone]

Another option might not be to use rcp at all, but use a chroot'd ftp environment on the AIX host instead... of course you'd either need to hard-code the password, or make the ftp anonymous

HTH

Duncan

[Gavin Clarke]

Hmmm, how about a script that user test can only execute, which copies files from a directory /home/test/dailycopy to /home/test on aix. Urgh, now I've said it I don't like it.

Or alternatively the other way around, get aix user to get the files as a cron job, using ftp?

Permissions still seems like the proper way.

[Caesar_3]

Hello!

If you want that some user could do something
and something else could not it's 99% permissions will solve the problem.

Caesar

[Chris Vail]

Use secure copy: that way the user can only hose his/her own files. Its also a lot easier to script, and you don't have to hard-code the passwords.


Chris

[Geoff Wild]

You could also write a "wrapper" script - that is, make the user run, say /usr/local/bin/rcp and it you have checks to where they are allowed to write too....the script itself would call the real rcp command...a bit ugly....and if the user figures it out - they could bypass your script...

Rgds...Geoff

[Ramesh Lanka]

hi Guys
thanks for all ur replies

Chris: what u mean by secure copy?

Ruban

[Massimo Bianchi]

Hi,
secure copy is scp, part of the ssh or openssh package.

It lets you establish connection between two server, crypting it, and it has lots of option for specifying all you need.

HTH,
Massimo