rsh Queries

[roobala]

Hi,

I wanted to use rsh/rksh for my webserver.
HPUX 11.00.
for the users they should be able to do anything in their home directory, but they shd not be ablr to come out of that.

ex:

user : guest
home directory : /home/guest

IF I enablr rsh for this user, he is not able to go back to /home from /home/guest, ie. fine.

But in his home directory he wants to create one directory named (data) /home/guest/data,
he could create it, but not able to go there.
cd command is not working, I saw the man page and found cd will not work in rsh.

How can I get my prob to be solved.
ie restriction on the backward directories reqd, not for the forward directories ie on the home directory of the user.

Thanks in advance
Roobala

[Frederic Soriano]

Hi,

Maybe you should consider using osh, another kind of restricted shell, with a lot more features than standard rsh bundled with HP-UX.

As described by its author:

"The Operator Shell (Osh) is a setuid root, security enhanced, restricted shell. It allows the administrator to carefully limit the access of special commands and files to the users whose duties require their use, while at the same time automatically maintaining audit records. The configuration file for Osh contains an administrator defined access profile for each authorized user or group. This profile lists the commands which may be run and specific access rights for files and directories. In addition to this fine grain distribution of privilege, all typed commands are logged along with a notation of their success or failure, offering a comprehensive audit log.

To the user, the Operator Shell looks like a standard C shell. It supports pipes, wildcards, aliasing, redirection, and environment referencing, except there is no longer any concept of a path. The user is restricted to only the specific commands and specific path to those commands, that the administrator chooses. To improve funcionality, some otherwise dangerous commands (more and vi) have been rewritten to support the Osh model of security. Osh does not interfere with file accesses a user would normally be able to perform. Additionally, it allows user access to file specified in the user's profile in the Osh configuration. For example, Osh can be configured to allow a user write access to a directory but to none of the files in it. Optionally a file is also readable if the file owner places a key in his home directory granting permission to a consultant, for example, to read his files. This gives a user specifically grantable control over his privacy."

You can retrieve latest version from:
http://www.engarde.com/~mcn/osh.html

and binaries for HP-UX:
http://hpux.cs.utah.edu/hppd/hpux/Shells/osh-1.7/

I hope this helps.

Best regards,

Fred.

[Bruce Regittko_1]

Hi,

You might also investigate using a standard shell and the chroot command.

--Bruce