Tag Info

Hot answers tagged

16

More similar Qs with more answers worth attention: http://stackoverflow.com/q/3859710/94687 http://stackoverflow.com/q/4410447/94687 http://stackoverflow.com/q/4249063/94687 http://stackoverflow.com/q/1019707/94687 some of the answers there point to specific solutions not yet mentioned here. (Actually, there are quite a few jailing tools with ...


10

Starting the process inside a network namespace that can only see the desired IP address can accomplish something similar. For instance, supposed I only wanted localhost available to a particular program. First, I create the network namespace: ip netns add limitednet Namespaces have a loopback interface by default, so next I just need to bring it up: ...


8

This is a fundamental limitation of the unix permission model: only root can delegate. You don't need to be root to run a virtual machine (not true of all VM technologies), but this is a heavyweight solution. User-mode Linux is a relatively lightweight Linux-on-Linux virtualization solution. It's not that easy to set up; you'll need to populate a root ...


6

Following the updated information, you should have them do private/public key pairs and inside the .ssh/authorized_keys file set it to only run script.php file. You shouldn't rely on the .bashrc for protection, especially since that is needed to initialize the environment.


6

command should not contain multiple words. This is the cause of the [ error you see. You should set any flags separately. Also, you should use pytivo_user to set the running uid, and not daemon -u. See the rc.subr(8) man page for all these magic variables. Also, you should let the rc subsystem know that pytivo is a Python script so that it can find the ...


6

login calls the login command/shell of the user with its argv[0] starting with a -. Shells check their argv[0] to determine if they're being called as a login shell. As @slm says, it's clearly specified in the "Invocation" section of the bash manual. In addition, a few shells like csh, tcsh, ksh, zsh, yash, bash and some variants of the Almquist shell ...


5

Normally bash knows that it's a login shell because when the login program invokes it, it tells bash that its name is -bash. That name is in argv[0], the zeroth command line argument, which is conventionally the way the user invoked the program. The initial hyphen is a convention to tell a shell that it's a login shell. Bash also behaves as a login shell if ...


5

The solution must probably be based either on ptrace or namespaces (unshare). ptrace-based solutions are probably less efficient then namespaces/unshare-based (but the latter technology is cutting-edge and is not well explored path, probably). ptrace-based UMView As for ptrced-based solutions, thanks to the comments at ...


5

I would suggest allowing to connect only via public key. Then you can connect that public key with your own command by supplying it in ~/.ssh/authorized_keys like that: command="/path/to/mycommand" ssh-rsa ... Whenever the user logs into that account with that key your command is executed instead of the usual shell. That command can for example be a shell ...


5

No matter the fancy name used here, both are solutions to a specific problem: A better segregation solution than classic Unix chroot. Operating system-level virtualization, containers, zones, or even "chroot with steriods" are names or commercial titles that defines the same concept of userspace separation, but with different features. Chroot was introduced ...


4

You can change shell for the user in question to whatever you like in the last field on the appropriate line in /etc/passwd, e.g.: specialuser:x:12345:123::/home/specialuser:/usr/bin/restricted_script.php if you include appropriate hash-bang (e.g. #!/usr/bin/php on the first line of the script) it should work right away. For security reasons I would ...


4

if you really want to lock down this user as much as possible create a virtual machine. The chroot don't really isolate this process. If a real virtual machine is too heavy, maybe you can have a look at linux containers, a lightweight version of virtual machine. Harder to configure though. If you want something even more lightweight you can try to ...


3

I just found out that I had mounted onto a directory which itself is already rebound (mounted via nullfs). /var/data/home/j/mroot on /var/data/home/j/www /var/data/home/js/www on /var/data/home/j/www/s /foo on /var/data/home/js/www/foo Besides being confusing this is apparently unsupported / wrong. I changed it like so (note the path in the last line): ...


3

make distribution just installs new configuration files, while mergemaster walks interactively over all config files and asks you which ones you want (and intelligently upgrades files you never edited in the first place if possible). It even gives you the option to merge them as needed. Basically, it automates the process of installing updated config files, ...


3

I doubt you could allow them to fully use all your programs but unable to read files outside of their home. All it would take is one program that depends on a configuration file to destroy that. You could create a virtual machine and give them user (or root) access to the virtual machine. Some common VM solutions are: Xen VirtualBox KVM OpenVZ


3

You need to run pulseaudio in system mode, and let all users access it, unfortunately, this is strongly discouraged by the upstream Pulseaudio developers. Here's a systemd service script that should improve on the above: # /etc/systemd/system/pulseaudio.service: [Unit] Description=PulseAudio Daemon [Install] WantedBy=multi-user.target [Service] Type=simple ...


3

Change the name of the executable (note that that also affects PAM configuration). ln /path/to/sshd /path/to/sshd-whatever Start as /path/to/sshd-whatever. And define PAM configuration in /etc/pam.d/sshd-whatever. Log entries will show as sshd-whatever instead of sshd.


2

One of the most easy/efficient way to control what a user can do is lshell. lshell is a shell coded in Python, that lets you restrict a user's environment to limited sets of commands, choose to enable/disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restriction, and more.


2

Jails get ip aliases on your network interface. If the jails use the same interface as the host and are on the same subnet you don't need to do any additional routing. If your jails do not use the same interface you would need to bridge the primary interface with the interface the Jails use.


2

You have a few options that will make your home directory (or part of it) off limits. Change your home directory to owner only access using chmod 700 ~. This will allow only you and root to access the directory. Move your home directory to an encrypted file system. (This will prevent them from accessing it when you don't have it unencrypted. Combine ...


2

You have 2 options: chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd/nonchroot.list Where file /etc/vsftpd/nonchroot.list should contail the users you don’t want to chroot. OR chroot_list_enable=YES chroot_list_file=/etc/vsftpd/chroot.list Where the file /etc/vsftpd/chroot.list should contain the users you want to be chrooted ...


2

Take a look at the bash man page. They discuss the differences in how it can be invoked there. The section is called INVOCATION. The 2 primary ways it get's invoked are as a login shell (bash -l) and as a interactive shell (bash -i). Take a look at this other Unix and Linux Q&A titled: Difference between Login Shell and Non-Login Shell?. It pretty much ...


2

You can use Subversion in basically the same way as documented for cvsup. In short: # portsnap update # cd /usr/ports/devel/subversion # make install clean Then to update /usr/src (assuming you have sources installed): # svn update /usr/src If sources are not already installed in /usr/src, you can check out a fresh working copy: # svn checkout ...


2

Firejail is a Linux namespaces sandbox program that can jail Firefox or any other GUI software. It should work on any Linux computer.


2

What desktop manager you are running does not matter; all that matters is that you provide the container with access to the Xwindows socket, the XAUTHORITY environment variable, and the file it points to.


2

I wasn't aware of Pulseaudio running on Fedora as audio server. After researching, I have finally found a way to share audio (microphone and speakers) among other users, while running Pulseaudio as normal user (myself) and not in System Mode. In order to do that you will only need to copy initial configuration file to your home directory: cp ...


1

Not directly. With technologies such as LXC or OpenVZ the applications inside them are essentially there own Linux boxes. So you'll need to do it "remotely" using tools such as X2go or VNC to see their remote desktops, or remotely display applications running inside them using X. There is this tutorial which discusses how to do this using Debian/Ubuntu, but ...


1

Modification of networking inside FreeBSD jail isn't allowed. A jail can use all host addresses, a few ones (restricted set, configured during a jail creating) or no networking at all. And, as far as I see, allowed IPs are automatically placed on interfaces seen inside the jail. You should specify exact FreeBSD version for updates of the question, because ...


1

Iron Bars Shell might be just what you're looking for. Iron Bars SHell, or short ibsh is my first attempt to create a restricted working environment for Linux/Unix. I'm sure that many system administrators wish or have wished for a way to lock some/all users into a safe dungeon, where they can only do harm to their own files. Here is some more ...


1

This sounds like basic ownership, group-ownership and permission bitss settings on the file. Your personal files are protected by your personal user-ID and personal group-ID. Files you want to share get a GID for friends/public. Check this website: http://catcode.com/teachmod/no_prob.html



Only top voted, non community-wiki answers of a minimum length are eligible