-1

I have a user test1 that i want to limit it to only run specific commands. I found this solution and I tested it (logged in with test1 and ran some random commands. none of them worked but date) and it worked. here is what i did:

cp /bin/bash /bin/rbash
useradd -s /bin/rbash test1
mkdir /home/test1/bin
chmod 755 /home/test1/bin
echo "PATH=$HOME/bin" >> /home/test1/.bashrc
echo "export PATH" >> /home/test1/.bashrc
chattr +i /home/test1/.bash_profile
ln -s /usr/bin/date /home/test1/bin

since I'm more of a DBA than a linux pro like you guys I don't know if this is enough and if there is any other thing i need to do to prevent this test1 from doing anything on system.any suggestion for increasing security?

as you can see, if i create link for a command like ifconfig:

ln -s /sbin/ifconfig /home/test1/bin 

this user test1 can also run add | del | up | down with ifconfig. how i can limit this command with for example this option -a or it can be executed with no options at all?

1

Ordinary users aren't permitted to change network interfaces.

e.g. my non-root user can view interface details with ifconfig:

$ ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether xx:xx:xx:xx:xx:xx  txqueuelen 1000  (Ethernet)
        RX packets 178399193  bytes 213874320365 (199.1 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 50539358  bytes 36748192570 (34.2 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device memory 0xba200000-ba21ffff  

but can't take the interface down:

$ ifconfig eth0 down
SIOCSIFFLAGS: Operation not permitted

In short, don't let them run ifconfig as root (e.g. with sudo) and you don't have to worry about it.

| improve this answer | |
  • what about other commands like ifconfig that have options? – BlackCrystal Aug 25 '19 at 10:39
  • they too will be restricted by the permissions on whatever file or device node or kernel parameter they are trying to change. e.g. as a normal user who is NOT in the disk group, I can't run even fdisk -l /dev/sda, let alone change the partition table - because the perms on /dev/sda don't allow me to. – cas Aug 25 '19 at 10:41
  • btw, you probably want to make .bashrc immutable as well as .bash_profile – cas Aug 25 '19 at 10:43
  • great point! ( since there are really important databases on these machines i'm REALLY worried about those who want to use this user. there are always unexpected exceptions that cause serious problems) – BlackCrystal Aug 25 '19 at 10:49
1

Have you tried running /bin/rm? And did you read the warning at the top of the article?

Disclaimer : This is just a hack, not recommended for Actual Production Use

I would also read the comments on this answer to a duplicate on Stack Overflow.

If you want to actually restrict a user securely you probably need to look into a permissions framework like SELinux or AppArmor.

| improve this answer | |
  • The accepted answer in that SO link is a terrible way to use rbash - it allows the restricted user to run any program except those that are blacklisted with aliases instead of setting the PATH to a directory containing only copies/links of whitelisted programs (incl. restricted editors, if an editor is needed, like rvim or rnano). BTW, even without apparmor or selinux, rbash is not easy to break out of, especially if there's only a small number of whitelisted programs that can be run. The whitelisting answer by Victor Wong is better (and is the method being used by the OP). – cas Aug 25 '19 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.