Restriction of Particular Commands

[Karthikeyan_5]

How to restrict particular commands say rm,ls,mkdir ..etc correspoding to the users.

[James R. Ferguson]

Hi:

You should utilize a "restricted shell". Look at the 'sh_posix' man pages for more information.

Essentially you create a directory called '/usr/rbin' and copy into it the commands the user is allowed to execute. Make sure to add this directory to the user's PATH.

The biggest drawback to this mechanism is that file output redirection is prohibited.

Regards!

...JRF...

[James R. Ferguson]

Hi:

You should utilize a "restricted shell". Look at the 'sh_posix' man pages for more information.

Essentially you create a directory called '/usr/rbin' and copy into it the commands the user is allowed to execute. Make sure to add this directory to the user's PATH.

The biggest drawback to this mechanism is that file output redirection is prohibited.

Regards!

...JRF...

[James R. Ferguson]

Hi:

You should utilize a "restricted shell". Look at the 'sh_posix' man pages for more information.

Essentially you create a directory called '/usr/rbin' and copy into it the commands the user is allowed to execute. Make sure to add this directory to the user's PATH.

The biggest drawback to this mechanism is that file output redirection is prohibited.

Regards!

...JRF...

[Dario_1]

Hi!!!

Check Jame's answer in this post.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xf9428b82cc91d711abdc0090277a778c,00.html

Regards,

DR

[Paul Sperry]

I do this by putting aliases in their .profile/.login s.

alias rm='cat /dev/null'
alias ls='cat /dev/null'

That way when they try using the command
nothing happens :)

[James R. Ferguson]

Hi (again):

As an additional, general note, you should set the sticky bit on shared directories. This restricts deletion of files in the directory to only the owner. For example:

# chmod 1777 /tmp

...while will appear as:

drwxrwxrwt

Regards!

...JRF...

[Geoff Wild]

How about chmod 550 the commands...

Restricted shell is a better way to go....if you are worried about users - then why do they have access at all?

IMHO - Just make sure your system is hardened so that they can only damage their own files....they should have the ability to delete files they create - else they will call you all the time - and you don't really want that now do you? :)

Rgds...Geoff