User account restriction

[Achilles_2]

I am going to setup a platform for training. So I need to create a user which they don't allow to access other users (eg. root) and commands . However they could use cd command to go to upper level.
Do any experts know how to setup a user account which can restrict the user to use the particular command (eg. ftp, cd)?

[RAC_1]

Assign rsh (restricted shell) to user. man rsh for details.

[Raj D.]

Archiles,
Any way you can setup an ordinary users , and they cannot acces the root equivallent commands. like ioscan , vgcreate , lvcreate , shutdown etc. Also you can use sudo.

If you use rsh you cannot do 'cd' etc..



You can check This thread:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1005655&admit=-682735245+1151039976246+28353475


Cheers,
Raj.

[Achilles_2]

command rsh will led the user cannot user cd to change the directory, but my question is considered that they couldn't go to upper level and could change to their children directory. Do anyone has an idea?

[Victor BERRIDGE]

Hi,

I suppose your best bet would be a chroot with in it a /usr/bin with the commands your users can use (do a man chroot)...

All the best
Victor

[Achilles_2]

Victor,

First thanks your help, can you explain detatil how to setup chroot user environment?

[Victor BERRIDGE]

Hi again,
Since we dont know what are your true needs its difficult to answer...
http://www.tjw.org/chroot-login-HOWTO/
http://www.kegel.com/crosstool/current/doc/chroot-login-howto.html

These two docs should help you understand how to create and what is to be done to meet your expectations.

I did one 2 years ago on solaris systems where the goal was to be able to see almost everything as if you were actually on the hosts...
The reason was the whole bunch of stations for conference purpose were connected directly to the internet...


All the best
Victor

[Steven E. Protter]

Shalom Achilles,

Based on your requirements if you want to restrict cd up towards root, you must chroot the user and provide the binary commands it needs inside the chroot jail.

SEP