0

I have 1 directory on a Unix server which is accessible to all currently as users logged in user name is common but they logged in to that user via sudo su -iu. I want only 10 users to have access on that directory and rest all shall not be able to access that directory.

ssh aaa@abc.com

sudo -su server1

/home/server1/

cd dir1 (the owner of this directory is user server1 and group is grp1 and whenever person1 and person2 logs in via sudo to this server, both of them will have same user and group ids for this user server1 on this server.

how we can restrict all the user accessing this directory except 8-10 folks?

  • 1
    Create a group, add those 10 users to that group, set the group as owner of the directory in question and set the right permissions. – Panki Feb 28 at 8:20
  • 1
    They are logging into that server and the becoming root. In that case, there isn't anything that you can do to keep them out of that or any other directory. Even if you put that directory on an NFS export and enabled root squash, they could still su - to a user with access and get into it. – Nasir Riley Feb 28 at 8:46
  • See also this, to make files created in the shared folders by each of the users also writable by the other users: superuser.com/q/277775/879179 – filbranden Feb 28 at 10:34
  • Thanks @NasirRiley but in my case user1 is logging in to via sudo on server1 user, not root sudo -iu server1 ( executed by user1 to logged in as server1 user) – anurag Feb 28 at 17:52
  • @anurag If they can sudo su user then they can just sudo su and become root unless the sudoers file has been modified to only allow that one command. – Nasir Riley Feb 28 at 17:56
0

In your solution, all users with sudo - rights will be able to Access the Directory, as they will get the same effective user id with "sudo".

To enable permissions to a certain Group of users, you Need to add them to a supplementary Group, and allow this Group to Access the Directory. The users then use their original Login to Access the Directory.

Do the following steps:

# add a Group for accessing the Directory
groupadd s1_group

# Add the Group to all users with Access to the Directory
usermod -a -G s1_group <user>

# Change the Directory permissions (Group writeable) and ownership (g: Group s1_group)
chown .s1_group /home/server1
chmod 770 /home/server1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.