Tag Info

Hot answers tagged

26

You can set that user's shell to rssh or scponly, which are designed precisely for that purpose: rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs. scponly is an alternative 'shell' (of sorts) for system administrators who would like to provide access to remote ...


16

The correct way according to usermod(8) is: usermod --lock --expiredate 1970-01-01 <username> (Actually, the argument to --expiredate can be any date before the current date in the format YYYY-MM-DD.) Explanation: --lock locks the user's password. However, login by other methods (e.g. public key) is still possible. --expiredate YYYY-MM-DD ...


16

Under no circumstances would anyone want to do that. This is what sudo is for, to give users the ability to run things as root. Giving a non-root user all the permissions of root is inadvisable because they would then be able to do literally anything, so if that user account was hijacked, you'd be in trouble. Summary of above: Don't try to give the user ...


12

The way I usually implement this kind of restrictions requires that several conditions are met, otherwise the restriction can be easily circumvented: The user does not belong to the wheel group, the only one authorized to use su (enforced via PAM). The user is given a properly secured rbash with a read-only PATH pointing to a private ~/bin, this ~/bin/ ...


11

Similar to the other answers, but in the direction you wanted. if [[ $EUID -eq 0 ]]; then echo "This script must NOT be run as root" 1>&2 exit 1 fi Alternatively, you can use sudo within the script to force execution as the non-privileged user using the -u flag to specify the user to run as. I don't use Glassfish, but here's a proto-example ...


11

I don't know how to do it with bash, but I know of another shell that restricts the user environment: lshell (limited shell). A quick overview of configuration Lshell is configured via an INI file. By default, it holds a whitelist of allowed commands, but it can be easily configured to prohibit user from using a specific command. This configuration ...


10

You don't need to create 'sybase' as a privileged user. See http://tldp.yolinux.com/HOWTO/Sybase-ASE-HOWTO.html for examples. Useful info: "create the sybase user group and then the sybase user as a member of it. This is an ordinary user that will be used mainly for starting the database server" bash$ su - root bash# groupadd sybase bash# useradd -g ...


10

useradd You can control how long a user's account is valid through the use of the --expiredate option to useradd. excerpt from useradd man page -e, --expiredate EXPIRE_DATE The date on which the user account will be disabled. The date is specified in the format YYYY-MM-DD. If not specified, useradd will use the default expiry date ...


9

There's a command option in authorized_keys file. This options seems to do exactly what you want. Note that it's not a chroot or a restricted shell. It's allowing to execute only those commands via ssh. With your example, it would be : ssh somehost /local/remote_only_scripts/foo For this authorized_keys file : ...


9

You could used a forced command if the users can only connect through ssh. Essentially, whenever the user connects through ssh with a certain key and a certain username, you force him to execute a command (or a script or) you determined in the .ssh/authorized_keys. Commands issued by the users will be ignored. For example: # in .ssh/authorized_keys ...


9

You could set the shell of that user to a script just running the command you want to allow: Whenever the user logs in, the command is run, then the user is logged out. And since there's no "full shell" you don't have to deal with the user trying funky stuff ;)


9

On the server side, you can restrict this by setting their user shell to /bin/true. This will allow them to authenticate, but not actually run anything since they don't get a shell to run it in. This means they will be limited to whatever subset of things SSH is able to offer them. If it offers port forwarding, they will still be able to do that. On the ...


7

To achieve this need following things : Method 1# By changing User's Home directory Make sure following line exists chroot_local_user=YES Set User HOME Directory to /var/www/ , if you want to change for existing user then you can use : usermod --home /var/www/ username then set required permission on /var/www/ Method 2# If you don't want to ...


6

Lock the password and change the shell to /bin/nologin. sudo usermod --lock --shell /bin/nologin username (Or more concisely, sudo usermod -L -s /bin/nologin username.)


6

This is a pretty standard reason to change the shell. Typically /bin/false or other shells like /bin/cat are used. Typically you can't escape from /bin/cat and it is unlikely that cat has a security bug but other methods may still work, like creating a DoS or bypassing Firewall rules. Another probably more severe problem is if you are using the ...


5

Do not do this. rbash should only be used within a chroot unless you know what you are doing. There are many ways to break out a restricted bash shell that are not easy to predict in advance. Functions can easily be overridden simply by doing command bash or command sh. As for your questions: You can't define multiple functions at the same time directly. ...


5

Git includes a git-shell command suitable for use as a Git-only login shell. It accepts exactly the following commands: git receive-pack git upload-pack git upload-archive git-receive-pack git-upload-pack git-upload-archive cvs server (used for emulating a CVS server, and not required for the Git protocol) So these are the only commands you ...


4

Apparently, you can. I never tried it myself, but jailkit seems to fit the bill. It doesn't seem to have been pre-packaged for Debian, so your only option is to build from source if you're on Debian or any of its children. Thanks to @terdon's comment, we know it's been packaged as RPM and as a source package for Arch. @terdon's links: RPM package Arch ...


4

You will need to ensure that the chroot that the users is put in has access to the directory by bind mounting into the chroot tree: mount --bind /Volumes/Storage /path/to/chroot The user will also need to have necessary filesystem permissions to read the data on the drive. The easiest way to accomplish this would be to put the user in a supplementary ...


4

You can use command keyword in authorized_keys to restrict execution to one single command for particular key, like this: command="/usr/local/bin/mysync" ...sync public key... Update: If you specify a simple script as the command you may verify the command user originally supplied: #!/bin/sh case "$SSH_ORIGINAL_COMMAND" in /path/to/unison *) ...


4

Add a dummy group, add the user to that group, chown root:somegroup /bin/mkdir, chmod g-x /bin/mkdir. Note that this relies on the user not being able to modify their groups. IIRC this is true in GNU/Linux but not in some other Unices.


4

if you remove the 2nd field of the /etc/passwd file then users can login without any challenge. Simply attempting to login will allow them in. So something like this is probably not something you'd want to do. root:$1$iM/2lekk$rXUAcF5fY8ddLL.B1bkH63:12242:0:99999:7::: /etc/passwd primer ...


4

if you really want to lock down this user as much as possible create a virtual machine. The chroot don't really isolate this process. If a real virtual machine is too heavy, maybe you can have a look at linux containers, a lightweight version of virtual machine. Harder to configure though. If you want something even more lightweight you can try to ...


3

Not on Linux. On Solaris you can use RBAC (Role Based Access Control) and provide additional permissions. On Linux the proper way to do this is to use sudo. We all do it. That is the way of things. The way of the Force.


3

You can remove execute permissions for the binaries you don't want the user to run. Create a new group, change the execute permissions (chmod go-rwx), and add the desired user to the group. (This is similar to how only certain users are allowed to use the sudo command.) Depending on what you want to achieve, chroot jail might also be useful. In case you're ...


3

If you are on Debian/Ubuntu you should use adduser and usermod. On Debian based systems useradd is considered low level and (according to the man pages): administrators should usually use adduser(8) instead adduser has a no expiration option, so you just use it to create the account. usermod has the -e / --expiredate option to set the expiration date. You ...


3

There are very many ways of achieving this, you need to have an idea of what "some other actions" are before you can choose the solution. Assuming that all you want is to prevent copying to usb devices, you could just prevent all usb storage devices from being mounted (blacklist that module). Or you could make the usb storage devices read-only (via udev), ...


3

If rsync is your one and only use case, you may want to think about simply exposing an rsync server that the user can connect to directly. A very detailed explanation for rsync + stunnel This is how you would access that service If you insist on SSH you could just disable login by setting that users shell to /bin/false, which would still allow you to use ...


3

Commands like chsh and passwd are coded specially. They run with extra privileges (they're setuid) root) and contain their own authorization mechanism. Both check which user is invoking them, and allow non-root users only a subset of their functionality. chsh and passwd are the exception. Most commands don't care who invokes them. Forbidding users from ...


3

Question #1 My question is, how do I restrict the command to just this SFTP transfer in the public key that is generated? There are 2 methods for doing this. 1. -- Restricting through sshd This method involves setting up the SFTP feature within your SSH daemon, sshd. This is controlled through the /etc/ssh/sshd_config configuration file. Note: ...



Only top voted, non community-wiki answers of a minimum length are eligible