Creating a user having only access to folder & sub-folder which is present in other user of the same System

Question

I have 2 users on my ubuntu system, User1 and User2.

I have a directory(folder) in User1 as /home/User1/Software and I want to set this Software folder as home directory of User2 so that whenever user2 logins he can see only Software folder that too only with read access to it.

If we remotely login to that system through User2 we are directly migrated to software folder with only read rights and can't access any other folder except Software and its sub-folder.

Answer 1

You need to change User2's account so that it uses a restricted shell such as rbash.

sudo chsh -s /bin/rbash User2

NOTE: this will only restrict the user's command-line shell (including logging in via ssh). It will not affect their GUI desktop environment e.g. if they log in on the console.

See man rbash for more details but some of the restrictions are that the user is prevented from:

· changing directories with cd

· setting or unsetting the values of SHELL, PATH, ENV, or BASH_ENV

· specifying command names containing /

· specifying a filename containing a / as an argument to the . builtin command

· redirecting output using the >, >|, <>, >&, &>, and >> redirection operators

· using the exec builtin command to replace the shell with another command

These restrictions are enforced after any startup files are read.

Blocking redirection may be excessive for your needs (or maybe not since the directory is readonly anyway), but unfortunately with rbash it's all or nothing.

Answer 2

How to Prevent a User From Seeing Any Files Under the /home Directory Except Their Own

Accomplish this by managing file permissions on the directories that you don't want the user to see.

Give the user a unique login name and group name. Check that they have no ownership on the system; get their numeric user id and group id and run:

sudo find / -uid n -o -gid n

Make all files under /home accessible only to user and group, not other.

sudo chmod -R o-rwx /home

To allow the other users on the system to see each others' files under /home, add them all to a common group, such as users, and set their umask to 002 (usually the default).

If you need more restrictions than this, you may investigate solutions involving rbash and/or chroot.