The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
1answer
116 views

How can I run ssh-add on demand? Can it act as SSH_ASKPASS?

I want to ssh from user@local to user@remote several times per day with an encrypted SSH key, a situation which ssh-agent handles with a good trade-off between security and usability. I'd also like ...
0
votes
1answer
38 views

A password is not necessary to enter my /home directory but after logging out password is necessary

I am facing a strange problem. I have an opensuse 42.1 leap Linux. I deleted my /home folder accidentally from my other linux which is Debian. For some reason I had to transfer everything from my ...
3
votes
2answers
89 views

Can users in a group access a file that is in another user's home directory?

I have 3 users A,B and C inside a group 'admin'. I have another user 'D' in whose home directory, there is a project folder. I have made D as the owner of that folder and assigned 'admin' as the group ...
1
vote
0answers
24 views

How to give chroot ssh access user access to /var/www/html [duplicate]

I followed this guide to set up chroot access for a vendor to our web server: http://geek.co.il/2010/03/14/how-to-build-a-chroot-jail-environment-for-centos It works and I have a chroot jail set up, ...
19
votes
7answers
3k views

Which access rights can't the superuser violate?

Fr. Br. George told in one of his lectures (it's in Russian) that there are some access rights that superuser can not violate. That is there are some access right which can forbid superuser doing ...
2
votes
1answer
31 views

The Safest Way to Deploy a Daemon via Jenkins

I'm developing a system service in Java, and for the deployment I would like to do the following: Copy over the new Initd from the build Stop the service being deployed Overwrite/copy the new ...
4
votes
2answers
70 views

Can an AIX user that appears in etc/group but not etc/passwd still log into a server?

Looking at etc/group and etc/passwd files, I see accounts listed in various groups in the etc/group file that do not appear in the etc/passwd files. Can these accounts still log in to the AIX server?
2
votes
1answer
115 views

How can I tell if someone has connected to my machine remotely?

One thing I have found very disappointing in computing is the lack of notification when someone connects to your computer. I do a lot of remote work and when I connect to anothers machine they get no ...
9
votes
3answers
2k views

Is it a good practice to run a daemon under a non-root user account?

I've developed an application that uses NTP to change the network time, to sync two of my computers. It runs as root, since only the latter is allowed to change the time and date on Linux(I guess). ...
3
votes
2answers
214 views

How do I remedy SELinux not allowing legit programs in use access to my system?

I have a system where some programs are getting access denied in SELinux when performing their duties. These programs are ClamAV, fail2ban and Logwatch. I think I've managed to allow all the access ...
14
votes
3answers
990 views

Myth or reality: SELinux can confine the root user?

I read or heard somewhere (maybe in LinuxCBT's SELinux course; but I'm not sure) that there are online Linux servers, for which the password of the root user is also given. The Linux server is ...
1
vote
0answers
165 views

Two users with the same 'home' folder but different '.profiles'

I would like to have at least two users signing in the same home folder, so them need to have full access to this folder, but with different 'profile' behavior. host-foo: user1 : /home/foo-folder ...
1
vote
1answer
37 views

Restrict a process to accessing only a specific directory

How could I run a process dostuff such that it can only access files/folders in the directory somedir?
0
votes
0answers
21 views

How do I grant write access to an API?

I'm trying to run the SOFA Matlab/Octave API version 1.0.1. Copyright 2013 Acoustics Research Institute. This API implements SOFA version 1.0. I've emailed them and they said "I need to grant write ...
0
votes
0answers
151 views

allow non-root user to run programs compiled by root in /root/bin

I just finished and installed ffmpeg installation on a centOS box via the guide made by ffmpeg themselves https://trac.ffmpeg.org/wiki/CompilationGuide/Centos As it turns out, ffmpeg was installed at ...
0
votes
0answers
13 views

What permissions apply if specific user's permission on file or directory differ from user's group to which this user belong to in Linux? [duplicate]

Case 1: User has "rwx" permissions to certain file or directory. But has no permissions "---" in group it belongs to. Question: who wins - Does user have "rwx" or "---", effectively (not what's ...
0
votes
0answers
182 views

Open serial port multiple times?

TL;DR: Can one application programmatically monitor COM port status of an already opened COM port, and how? I have a data communication from host HOST via ttyS0 (COM1) to another device CLIENT, so ...
0
votes
4answers
179 views

sudo for command with specific options

Is it possible to configure sudo to get root privilege to a user for running a program with some special switches? for example, how can I configure it for user admin to run netstat command as the root ...
4
votes
2answers
296 views

Unix/Linux equivalent of Windows' Bypass Traverse Checking

Windows has a privilege called "Bypass Traverse Checking" (also known as SeChangeNotifyPrivilege). It allows the system to bypass ACL checks in parent objects so a user can [potentially] access a ...
0
votes
1answer
53 views

UNIX Account management

Would like to know if there's some opensource solution aimed to manage and administer system authentication and RSA keys for staff, contractors and clients across the organization. My systems to ...
3
votes
1answer
275 views

CUPS and printer security

I would like some help on securing a networked printer. Specifically, I'm interested in the following: Preventing unauthorized access to the printer: I would like only certain laptops that connect ...
0
votes
1answer
40 views

Best solution for WebServer in Web developer's company

I'm looking for best solution about hosting web projects on linux server. My focus is on permissions and ACL's. Example We have 3 project and 3 developers , They have access to files via Samba Share ...
0
votes
1answer
200 views

CRON session entries in logs

I'm having this in my RaspberryPi /var/log file Feb 26 21:17:01 raspberrypi CRON[15182]: pam_unix(cron:session): session opened for user root by (uid=0) Feb 26 21:17:01 raspberrypi CRON[15182]: ...
1
vote
3answers
68 views

Limit access to a single host

I have two 2 hosts (A and B), each with a single network interface, directly connected to a 3G router, via the LAN ports. I've configured both host A and B gateway to point to the 3G router. However, ...
3
votes
2answers
58 views

How is the visibility of a file-system mount limited?

If a user mounts an encrypted file system, is it possible to limit the visibility of that file system such that other users are not able to view it or even see that the file system is mounted?
1
vote
1answer
121 views

Group member cannot list files in directory made by group

I am using Centos 6.6. I made a group with the following call sudo groupadd www-OtagoHarbour sudo usermod -G www-OtagoHarbour apache sudo usermod -G www-OtagoHarbour OtagoHarbour When I enter ...
11
votes
2answers
716 views

Can I make a file only accessible to a script, and not a user?

I have a user with limited access on the system (that is, he is not a sudoer); let's call him Bob. I have a script or a binary which I, the system administrator, trust, and would have no problems ...
2
votes
1answer
99 views

what does Xserver access control mean

What meaning does Xserver access control have, when the Xserver is started with tcp disabled: /usr/bin/X11/X -nolisten tcp AFAIU, Xserver can be used to allow remote network connection. But, if it ...
1
vote
2answers
252 views

Lightweight SSH-only distro (< 128 MiB RAM) [closed]

I am looking to set up an SSH entry point into my network via a lightweight Linux or BSD setup. The purpose of the distro will be to allow SSH access into the rest of the internal network—that's it. ...
2
votes
1answer
110 views

Do root's supplementary groups behave differently than regular account ones for NFS shares?

OS: Linux CentOS 7, NFSv4 On one machine I exported an NFS share group-owned by the nfsgroup with 2770 privileges for group collaboration: groupadd -g 5000 nfsgroup chown nobody:nfsgroup ...
2
votes
1answer
28 views

Parentals Controls? [closed]

How do we implement parental controls? We have a customer with multiple retail locations and one computer at each. They switched to Ubuntu to lock down the computers, but many of the employees are ...
0
votes
1answer
1k views

Grant FTP access to specific directory

I have setup CentOS on a box on my local network and installed httpd, PHP, Webmin (and UserMin) etc. I opted for ProFTPd and have opened up ports for FTP, Webmin and Apache. I can now access Webmin ...
22
votes
4answers
24k views

How to check if a user can access a given file?

*nix user permissions are really simple, but things can get messy when you have to take in account all the parent directory access before reaching a given file. How can I check if the user has enough ...
1
vote
1answer
645 views

ssh settings `permitopen=“localhost:4000”` does not limit remote port forwarding [duplicate]

I have a special user on my server, let's call it foo. I use it only for port forwarding. The user's .ssh/authorized_keys2 is set up to prevent login and to open only a specific port: ...
3
votes
2answers
329 views

How to allow access to a directory and don't allow access to a sub-directory in Apache?‏

I have asked this question on apache mailing-list but I didn't get the answer I want. I want to allow a directory " /var/www/html/ldap" to two users according to IPs (192.168.1.2 192.168.1.7): ...
2
votes
0answers
147 views

Easiest way to sandbox an user

I'd like to sandbox a user so that they can only read files under /media/shared/somefolder. What's the easiest way to accomplish this? Users/groups? ACL? AppArmor? Some context: Plex Media Server is ...
0
votes
0answers
31 views

Permisison/Ownership issue with secondary FTP account

I have Centos 6.5 final. I have chroot setup and working properly and I also installed vsftpd. I now need to create a new user named extDeveloper and give this user access to a specific account. I ...
3
votes
2answers
4k views

Chroot SFTP users who require access to multiple directories under same parent folder

I have a RHEL 6 server with a /Documents directory, and it has child directories 1 2 3 4 5.... right under the /Documents directory. Is it possible to create an SFTP chroot jail that only gives a ...
1
vote
0answers
25 views

How can I use iptables to block certain processes from accessing the network? [duplicate]

I can set the processes to run under special uid's and use the technique from this SF answer: -A OUTPUT -m owner --uid-owner 400 -j DROP ...But are there any other ways to blacklist based on the ...
2
votes
2answers
384 views

What is “access control” with X Server?

What is an access control restriction with an X Server? There is the -ac option that "disable access control restrictions" with e.g. Xephyr. I saw some example using that option, but I have no idea ...
1
vote
0answers
29 views

What forms of discretionary access control are there?

I know it's kind of an unguided question, but just so I have a broader sense of how things are I was interested in getting a reasonably complete list of discretionary access controls available on Unix ...
2
votes
0answers
50 views

Set list of applications allowed for execution by unprivileged user

I am working on a project of security enforced Linux-based system (kernel 2.6.32 + Gnome 2 + Centos package base mostly). We need to implement the restriction of execution of unallowed executables. ...
2
votes
2answers
47 views

Specialized access control for directories in RedHat

I have a requirement where I want to change permissions for a directory so that the directory owner (user/group) would be able to create files inside the directory and modify them, but won't be able ...
4
votes
1answer
539 views

allowing users to access certain ports on server

I have an RHEL 6 system which has 20 users. I have 20 ports on which separate versions of a service is running. I want user a to access port a, but not other ports. Is there a way to do this? ...
0
votes
0answers
202 views

How do i block USB devices based on device class in Linux

Problem Statement In windows server to provide access to USB devices are managed by GFI EndpointSecurity. Is there any open source tool in Linux which can do the same job. I want to block USB ...
6
votes
1answer
2k views

How can I enable URL rewriting on a DD-WRT router?

I would like to be able to add a parameter to certain URL requests that go through my DD-WRT router. Specifically, I'm trying to figure out how to force safe search in Google, which means I have to ...
3
votes
1answer
253 views

Can systemd do some setup before forking as a user?

Having written several small daemons or web applications for my personal use, I like to manage them using systemd (I am using Arch Linux, if that matters). So I write service files like the one below: ...
3
votes
2answers
2k views

Add ssh user with minimum rights for backup [duplicate]

I have a small server running Debian and I want to add an account with SSH access for backups. The user of this account should have no console access. He can only transfer (backup) data via SCP ...
6
votes
2answers
1k views

Restrict particular applications from accessing certain files

Normally the private files stored in the home directory of a user can be accessed by applications running with the effective UID of the user. How can I restrict a particular application from accessing ...
0
votes
1answer
196 views

not able to login by ftp

I've installed vsftp and set the home directory of user ftp with sudo usermod -d /var/www/ ftp , I've also set the password with sudo passwd ftp and restarted the server but I can not login with user ...