2

I have a Linux installation with a default user and an admin user (and root). On startup, the default user is automatically logged in and a particular application is launched. My intention is to prevent the default user from performing any actions that aren't part of the running application. One of the applications actions is to allow some administrative functions which I am thinking would be performed via sudo-ing or ssh-ing as the admin user.

Is it possible to limit the default user the way that I'm describing? I've already setup groups to allow the default user some write access to a database and I've limited their access to the terminal. I've researched chroot-ing and sudo based permissions but I'm not sure which (if any) is the more correct method of permission management or if either is even necessary. Regarding sudo versus ssh for admin access, which is better (or is something else better)? I know there is a lot of Linux permission information out there but I'm having trouble collating it all into a solution that fits this particular problem.

  • Until someone comes along with a better answer you may want to look at this: superuser.com/questions/444436/… – krowe Jun 17 '14 at 20:55
  • Can you describe your "problem" in more detail? What tasks does your default user have to do? Why do you want to limit that user - what are your concerns? – Nils Jun 17 '14 at 21:03
  • I think you're looking for a kiosk. Try looking through the kiosk tag to see if we have a question and answer that matches what you're trying to do. – Gilles 'SO- stop being evil' Jun 17 '14 at 23:06
  • Use a kiosk or perhaps a guest account. Both Fedora and Ubuntu have a guest account that is confined by selinux and apparmor respectivly. See docs.fedoraproject.org/en-US/Fedora/13/html/… – Panther Jun 17 '14 at 23:54
  • @Nils In general, all users should only be able to interact with the one running application that auto-launches at startup. It's a Java app and crashes can occur that might drop the user to the desktop (CentOS). I want to limit them basically to prevent any unintended actions on their part. I'm not trying to harden the system, just make it easier to avoid mishaps in the case of application crashes. – OttPrime Jun 18 '14 at 11:59
0

Normal users can not do much harm on linux.

But you should check that memory and number of process limits are in place. ulimit -a will show the current settings.

Another thing is the DB access from your java app. That app. should use different access users for different access roles.

Do not use SysDba or comparably privileged accounts in your application.

I see no need for sudo/root in this case.

| improve this answer | |
  • Most of the issues I'm concerned about can be handled well by setting up a kiosk mode and by using proper permissions. I'm accepting this as the answer since it covers part of the solution. – OttPrime Jul 16 '14 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.