Preventing user to delete file

[Ammar_4]

How can we prevent any user from deleting the file so that he couldn't delete any file

[Rajeev Shukla]

You have to be really carefull with the file permission, specially the important files you dont want to get deleted.
But you cant really get away with the files he owns. The files he owns, he can delete,modify etc.. but with the other files and directories make sure that they are not world writeable, avoid 777 permissions.
Run to find commands to see the security holes in system like find -mode
Enable ACL support if you like to give more deep control over the permissions of files.

[morganelan · Accepted solution]

I think you must do :
1.Backup all your file systems such as OS, user data, database, and application file.
2.Disable rm command for certain user

[morganelan]

I Think you need rksh as users default shell. Please see man rksh for more detail.
Users then can not

Change directory
Set value of SHELL, ENV, or PATH
Specify path or command names containing /
Redirect output (>, >|, <>, and >>)"

1)Create user accounts, you can use sam() or command useradd.
Assign users restricted shell
2)To restrict available command(s),

2a) Create a directory /usr/rbin and copy Copy (or symbolic link) commands you want to give access to, e.g. date,ls,pwd,banner
etc.
2b)Create users .profile file in home directory with the PATH variable:
export PATH=/usr/rbin
2c)Ensure the user owns his .profile file in
the home directory.

Test it. After you create these accounts, login as restricted user and command access will be limited to /usr/rbin.
Plus the standard rsh restrictions also apply.

[Ammar_4]

how can i disable rm command for specific user

[morganelan]

Put in user's .profile file this entry:

alias rm = '/sbin/rrr.sh'

because rrr.sh does not exist on the system so user can not use it

[Bill Hassell]

You can always alias the rm command to do nothing, or to report to the user that rm is forbidden. But it sounds like this, or perhaps several users should not be allowed access to the system, or not be allowed shell access. The best solution is to create a menu script that provides only the required commands and nothing else. I am assuming that the problem users do not have root access. If they do, install sudo immediately and never give out the root password. And make sure that the sudoers file restricts allowable commands.

[Ammar_4]

thanks