1

I need to create a user that only has access to everything within their own home directory. For example, if their username is stash, then they would only have access within /home/stash.

Running on Linux (Raspbian)

I was thinking of making a group solely for this one user which took away permissions from every file and directory outside of their home directory but I'm not all too familiar with working with permissions in Linux.

4
  • 1
    Is this homework?
    – waltinator
    Nov 15, 2020 at 21:29
  • There he is ... :) tldp.org/LDP/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/… is probably mostly along the lines of what you need. Depending on the distro you're using the required steps are likely to differ ...
    – tink
    Nov 15, 2020 at 21:41
  • 1
    @waltinator no lol, just for a project of mine
    – user442120
    Nov 15, 2020 at 21:45
  • 2
    You need to understand that taking all the permissions away will make it impossible for this user to log (can't access /bin/sh or any other shell) in or do anything at all in the system. Probably you have something different in mind. Nov 15, 2020 at 22:12

1 Answer 1

0

If you will use SSH to login then a chroot can be an option ; let's support we have a user named testusr which will have as home directory /var/chroot/home/testusr :

Note that the above must be executed as root :

# Create the needed dirs
mkdir -p /var/chroot/{lib,lib64,etc,home,usr}
# Create the user account 
useradd -d /var/chroot/home/testusr testusr
echo "testusr:testusr" | chpasswd 
cd /var/chroot
# Create some basic dev nodes that will be needed by the terminal
mknod -m 666 null c 1 3
mknod -m 666 tty c 5 0
mknod -m 666 zero c 1 5
mknod -m 666 random c 1 8
#Make available the needed libraries
mount -o bind /lib /var/chroot/lib
mount -o bind /lib64 /var/chroot/lib64
mount -o bind /usr /var/chroot/usr
# Set the correct permissions
chown root:root /var/chroot
chmod 755 /var/chroot
# Set the jail on sshd daemon
cat <<EOF >> /etc/ssh/sshd_config
Match user testusr
    ChrootDirectory /var/chroot
EOF
# Restart sshd daemon
systemctl restart sshd
# Set the default shell for the user &  copy the content of /etc/group and /etc/passwd to the jail
usermod -s /usr/bin/bash testusr
cp /etc/{passwd,group} /var/chroot

Also note that the bind mounts should be permanent ( add them to /etc/fstab ) in case of this is not for a testing purpose.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.