Restricted User Access

[Dhananjaya Amarakoon]

Hi Friends

I got the requirement to create user account in my Rx server that running HP-UX 11.23 and that user only can access a particular folder only (/oracle/bscs/CDR)

So I create a user with default shell as /usr/sbin/rsh and change user account home directory as (/oracle/bscs/CDR)

So my requirement is that the user only allow to access this folder contains only. When I implement this he can't go to parent directory as expected, but he couldn't able to go child directories also .

So how can I overcome this problem (allow him to go to child directories of CDR ) and implement above requirement?

Thanks & Regards

Dhananjaya Amarakoon

[Matti_Kurkela · Accepted solution]

With a restricted shell, changing the directory is not permitted.

Ideally, setting up a system like this requires only a good system-wide permissions design.

"Can access nothing but /oracle/bscs/CDR" very seldom means exactly that: if the user does not have read access to /etc, things like UID->username mapping and DNS resolving stop working for that user. If /dev/null is not accessible, many commands work strangely or not at all. If /usr or /lib is not readable, almost all commands become non-functional, because either the command binaries or the libraries they need are not available.

You could create specific groups for all sub-sets of your data according to access requirements, then join your user and application accounts to various groups as needed.

With a traditional Unix permissions model, a file belongs to one group only, but an user can be a member of multiple groups simultaneously. When the users get their access permissions via group memberships, you can "chmod o-rx" the data directories.

This kind of permission scheme is easiest to set up in a new system: changing an old system to use a new permission scheme is usually a lot of work.

With some careful pre-planning, you can satisfy all but the most complicated access needs; if you need more, you can use ACLs to fine-tune the permissions.

If you use ACLs, ensure your backup system can backup and restore the ACL information too. If your backup system does not handle ACLs on HP-UX filesystems, you should keep your ACL setup as simple and well-documented as possible, and write+test a script that can correctly re-generate the necessary ACLs on restore.

A different possibility would be to set up a chroot jail for that user. A chroot jail makes the jailed user see the jail directory (e.g. /oracle/bscs/CDR) as the root directory "/", so the things "above" the jail directory simply won't exist in that user's viewpoint.

This is easier to do if the requirement is for FTP or SFTP access only: if the user needs full shell access, you must provide (suitably limited) copies of essential directory trees like /dev, /etc, /lib and /usr as /oracle/bscs/CDR/dev and so on.

Symbolic links won't work in this case: if you create a link like

ln -s /dev /oracle/bscs/CDR/dev

it will just point to itself when viewed inside a chrooted environment.

MK

[Ivan Ferreira]

He should not need to cd to child directories as he can specify the commands and reference the files using the paths.

You should also consider the use of SSH and chroot, please see:

http://www.docs.hp.com/en/T1471-90011/ch01s12.html

[Steven E. Protter]

Shalom,

I would suggest a chroot environment.

That will permit access.

Use ssh.

http://docs.hp.com/en/T1471-90015/ch01s15.html

SEP

[Dhananjaya Amarakoon]

Hi Matti Kurkela,Ivan Ferreira and Steven E. Protter

Thanks for the guide me. As you suggested I will go to impliment chroot environment for this user.

Thanks & Regards

Dhananjaya Amarakoon.