I have a user who can even use sudo. I want to limit his access to his home directory only. nothing else at all. I created a group ' limited ' and moved him to this group. Now What?
How shall I limit his access to his home directory only?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this communityIt is much more difficult to prevent some particular access than to by default block all access and add specific exceptions for each kind of access. There is even a catchy term for this principle. Therefore, ensure that the commands that can be run via sudo
are explicitly specified so that the user can never become root
using it. After this has been done you have a couple of choices:
Restrict directory permissions (option1). Ensure that all directories in the root (/
) directory on the system have their execute bit turned off for the others permission group. This usually means running something similar to the following:
$ chmod o-x <dir>
Also do the same for all directories where the above has already been run but having a group to which this user is a member (at least the limited
group as per your question). This means running:
$ chmod g-x <dir>
This changing the directory execute permission on major top-level directories might not be practical: There likely are important processes that depend on being able to change directory (e.g. to /
or /var
) without any elaborate permission setup. But you could do this for at least a few private directories.
Use chroot jail (option 2). I reckon the realistic option is to use a chroot jail so that the user gets info a restricted environment immediately after login. Apart from setting up the chroot environment the OpenSSH server will have to be suitably configured as well. This does assume that access to the system is available via ssh
only. Alternatively, you could use Jailkit that has been discussed here.
In Unix, to do even the most basic stuff, a user needs access to sundry resources (executables, libraries, configuration files, manual pages, examples, ...). Even what is considered "normal commands" like cp(1)
, ls(1)
, are regular programs run by the user, who will need to be able to access them. Users need access to much of the system, that can't be cut off without making the system next to useless.
If you want users not to be able to rummage around the files of other users, that is covered by (now traditional) Linux configuration of user homes: Say Joe Sixpack's user is joe
. An account (UID) with name joe
and with primary group joe
is created for him, his home is owned by joe
and group joe
, and permissions like dwrx------
(I.e., joe
can read, write, and search; nobody in group joe
except for Joe himself; and nobody else, can do anything).