Limit a user to his own home directory

Question

I have a user who can even use sudo. I want to limit his access to his home directory only. nothing else at all. I created a group ' limited ' and moved him to this group. Now What?

How shall I limit his access to his home directory only?

Answer 1

It is much more difficult to prevent some particular access than to by default block all access and add specific exceptions for each kind of access. There is even a catchy term for this principle. Therefore, ensure that the commands that can be run via sudo are explicitly specified so that the user can never become root using it. After this has been done you have a couple of choices:

• Restrict directory permissions (option1). Ensure that all directories in the root (/) directory on the system have their execute bit turned off for the others permission group. This usually means running something similar to the following:

  $ chmod o-x <dir>
  

  Also do the same for all directories where the above has already been run but having a group to which this user is a member (at least the limited group as per your question). This means running:

  $ chmod g-x <dir>
  

  This changing the directory execute permission on major top-level directories might not be practical: There likely are important processes that depend on being able to change directory (e.g. to / or /var) without any elaborate permission setup. But you could do this for at least a few private directories.

• Use chroot jail (option 2). I reckon the realistic option is to use a chroot jail so that the user gets info a restricted environment immediately after login. Apart from setting up the chroot environment the OpenSSH server will have to be suitably configured as well. This does assume that access to the system is available via ssh only. Alternatively, you could use Jailkit that has been discussed here.

Answer 2

In Unix, to do even the most basic stuff, a user needs access to sundry resources (executables, libraries, configuration files, manual pages, examples, ...). Even what is considered "normal commands" like cp(1), ls(1), are regular programs run by the user, who will need to be able to access them. Users need access to much of the system, that can't be cut off without making the system next to useless.

If you want users not to be able to rummage around the files of other users, that is covered by (now traditional) Linux configuration of user homes: Say Joe Sixpack's user is joe. An account (UID) with name joe and with primary group joe is created for him, his home is owned by joe and group joe, and permissions like dwrx------ (I.e., joe can read, write, and search; nobody in group joe except for Joe himself; and nobody else, can do anything).