Tag Info

Hot answers tagged

10

More similar Qs with more answers worth attention: http://stackoverflow.com/q/3859710/94687 http://stackoverflow.com/q/4410447/94687 http://stackoverflow.com/q/4249063/94687 http://stackoverflow.com/q/1019707/94687 some of the answers there point to specific solutions not yet mentioned here. (Actually, there are quite a few jailing tools with ...


8

This is a fundamental limitation of the unix permission model: only root can delegate. You don't need to be root to run a virtual machine (not true of all VM technologies), but this is a heavyweight solution. User-mode Linux is a relatively lightweight Linux-on-Linux virtualization solution. It's not that easy to set up; you'll need to populate a root ...


5

login calls the login command/shell of the user with its argv[0] starting with a -. Shells check their argv[0] to determine if they're being called as a login shell. As @slm says, it's clearly specified in the "Invocation" section of the bash manual. In addition, a few shells like csh, tcsh, ksh, zsh, yash, bash and some variants of the Almquist shell ...


5

I would suggest allowing to connect only via public key. Then you can connect that public key with your own command by supplying it in ~/.ssh/authorized_keys like that: command="/path/to/mycommand" ssh-rsa ... Whenever the user logs into that account with that key your command is executed instead of the usual shell. That command can for example be a shell ...


4

Following the updated information, you should have them do private/public key pairs and inside the .ssh/authorized_keys file set it to only run script.php file. You shouldn't rely on the .bashrc for protection, especially since that is needed to initialize the environment.


4

The solution must probably be based either on ptrace or namespaces (unshare). ptrace-based solutions are probably less efficient then namespaces/unshare-based (but the latter technology is cutting-edge and is not well explored path, probably). ptrace-based UMView As for ptrced-based solutions, thanks to the comments at ...


4

Normally bash knows that it's a login shell because when the login program invokes it, it tells bash that its name is -bash. That name is in argv[0], the zeroth command line argument, which is conventionally the way the user invoked the program. The initial hyphen is a convention to tell a shell that it's a login shell. Bash also behaves as a login shell if ...


3

I just found out that I had mounted onto a directory which itself is already rebound (mounted via nullfs). /var/data/home/j/mroot on /var/data/home/j/www /var/data/home/js/www on /var/data/home/j/www/s /foo on /var/data/home/js/www/foo Besides being confusing this is apparently unsupported / wrong. I changed it like so (note the path in the last line): ...


3

You can change shell for the user in question to whatever you like in the last field on the appropriate line in /etc/passwd, e.g.: specialuser:x:12345:123::/home/specialuser:/usr/bin/restricted_script.php if you include appropriate hash-bang (e.g. #!/usr/bin/php on the first line of the script) it should work right away. For security reasons I would ...


3

command should not contain multiple words. This is the cause of the [ error you see. You should set any flags separately. Also, you should use pytivo_user to set the running uid, and not daemon -u. See the rc.subr(8) man page for all these magic variables. Also, you should let the rc subsystem know that pytivo is a Python script so that it can find the ...


3

make distribution just installs new configuration files, while mergemaster walks interactively over all config files and asks you which ones you want (and intelligently upgrades files you never edited in the first place if possible). It even gives you the option to merge them as needed. Basically, it automates the process of installing updated config files, ...


3

I doubt you could allow them to fully use all your programs but unable to read files outside of their home. All it would take is one program that depends on a configuration file to destroy that. You could create a virtual machine and give them user (or root) access to the virtual machine. Some common VM solutions are: Xen VirtualBox KVM OpenVZ


2

One of the most easy/efficient way to control what a user can do is lshell. lshell is a shell coded in Python, that lets you restrict a user's environment to limited sets of commands, choose to enable/disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restriction, and more.


2

Jails get ip aliases on your network interface. If the jails use the same interface as the host and are on the same subnet you don't need to do any additional routing. If your jails do not use the same interface you would need to bridge the primary interface with the interface the Jails use.


2

You have a few options that will make your home directory (or part of it) off limits. Change your home directory to owner only access using chmod 700 ~. This will allow only you and root to access the directory. Move your home directory to an encrypted file system. (This will prevent them from accessing it when you don't have it unencrypted. Combine ...


2

You need to run pulseaudio in system mode, and let all users access it, unfortunately, this is strongly discouraged by the upstream Pulseaudio developers. Here's a systemd service script that should improve on the above: # /etc/systemd/system/pulseaudio.service: [Unit] Description=PulseAudio Daemon [Install] WantedBy=multi-user.target [Service] Type=simple ...


2

You have 2 options: chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd/nonchroot.list Where file /etc/vsftpd/nonchroot.list should contail the users you don’t want to chroot. OR chroot_list_enable=YES chroot_list_file=/etc/vsftpd/chroot.list Where the file /etc/vsftpd/chroot.list should contain the users you want to be chrooted ...


2

Take a look at the bash man page. They discuss the differences in how it can be invoked there. The section is called INVOCATION. The 2 primary ways it get's invoked are as a login shell (bash -l) and as a interactive shell (bash -i). Take a look at this other Unix and Linux Q&A titled: Difference between Login Shell and Non-Login Shell?. It pretty much ...


2

You can use Subversion in basically the same way as documented for cvsup. In short: # portsnap update # cd /usr/ports/devel/subversion # make install clean Then to update /usr/src (assuming you have sources installed): # svn update /usr/src If sources are not already installed in /usr/src, you can check out a fresh working copy: # svn checkout ...


1

I wasn't aware of Pulseaudio running on Fedora as audio server. After researching, I have finally found a way to share audio (microphone and speakers) among other users, while running Pulseaudio as normal user (myself) and not in System Mode. In order to do that you will only need to copy initial configuration file to your home directory: cp ...


1

Modification of networking inside FreeBSD jail isn't allowed. A jail can use all host addresses, a few ones (restricted set, configured during a jail creating) or no networking at all. And, as far as I see, allowed IPs are automatically placed on interfaces seen inside the jail. You should specify exact FreeBSD version for updates of the question, because ...


1

Iron Bars Shell might be just what you're looking for. Iron Bars SHell, or short ibsh is my first attempt to create a restricted working environment for Linux/Unix. I'm sure that many system administrators wish or have wished for a way to lock some/all users into a safe dungeon, where they can only do harm to their own files. Here is some more ...


1

This sounds like basic ownership, group-ownership and permission bitss settings on the file. Your personal files are protected by your personal user-ID and personal group-ID. Files you want to share get a GID for friends/public. Check this website: http://catcode.com/teachmod/no_prob.html


1

Depending on what "fully use all my programs" means, the options are: Use standard Unix file permissions to protect your files. The advantage here is that it's really easy to set up as it's just a matter of deciding which files you want protected and setting the appropriate permissions on them. The downside is that your friend will not be able to do ...


1

Under Ubuntu, another way of jailing is apparmor! It is a path based mandatory access control (MAC) Linux Security Module (LSM). In Ubuntu 10.04 it is enabled by default for selected services. The documentation is quite fragmented. The Ubuntu documentation could be ... better. Even the upstream documentation does not give a good introduction. The reference ...


1

There is another way to jail it down: iptables using the owner match extension! With iptables it is possible to block outgoing (OUTPUT) network traffic by all processes of the slave-user. This is very easy to setup, i.e. it is convenient. That means that with this easy setup you can jail your slave-process from filesystem locations and the network. $ ...


1

One option is to put them in a restricted shell session, such as rbash [bash -r]. It is a bit unclear at this point what, exactly, you wish to accomplish, however, on the surface posix acl's for 'other' will apply to the new account as well as any group acl's for groups to which the account belongs, such as 'users' for example.


1

If you give somebody a shell account, they can see all world-readable files. This includes many files in /etc that are necessary for the system to work, including /etc/passwd (which contains user names but not passwords). If you allow the user only to log in inside a chroot, they can't see the files outside the chroot. That means you must put enough ...


1

Keep in mind that parts of /etc are required to be readable even by unprivileged users. If there are things in /etc that shouldn't be readable but are, you have bigger issues and at minimum should run your distribution's permissions check/fix program. A jail is the easiest way to set up draconian restrictions. There are other ways, such as setting up ...



Only top voted, non community-wiki answers of a minimum length are eligible