7

I have root access to my local server. And some days ago my colleague created a user on that server, giving me the uesrname and password. But the user has a minimized permissions. Like the user can't even create a file under its own home directory.

Is there any concept about "the permissions of a user"? If there is, how do I check/modify it?

7

It may be the case that your colleague, while creating the account, created the home directory "by hand" which resulted in it being owned by root. Try running the following as root:

chown -R username ~username
chgrp -R $(id -gn username) ~username

Where username is the name of the problematic account.

Edit

If this turns out to be your problem, to avoid this happening in the future, you want to add the -m switch to the useradd command line used to create the user account. This ensures that the user's selected home directory is created if it doesn't exist. This creates the home directory with the "right" ownership and permissions so you don't face this kind of issue.

Edit 2

The chgrp command added above will change group ownership of the entire home directory of username to username's primary group. Depending on your environment, this may not be exactly what you want and you'll possibly need to change group ownership of specific sub-directories inside the home-directory "manually", thereby setting different group ownership for different sub-directories. This is usually not the case for personal computers, but since you mentioned "a colleague", I'm assuming we're talking about a networked office environment, in which case group ownership is important for shared directories.

1

There isn't really any method for doing this in Unix, in a systematic way as you're asking. If you make use of sudo you can create something like you're asking about, but it's going to be completely artificial and very limiting in how thorough a list it can provide. In sudo you can create groups of commands and then allow user's (or groups of users) access to these groups of commands.

Example

# /etc/sudoers
someuser ALL=/sbin/service, /sbin/chkconfig

You can then use the command sudo -l as someuser to see what commands they're allowed to run.

$ sudo -l
...

User someuser may run the following commands on this host:
    (ALL) ALL
    (root) /sbin/service, (root) /sbin/chkconfig, (root)
1

As Joseph R. suggests, the likely explanation is that the home directory was not created with the right ownership. In 99% of the cases, access problems are just a matter of getting the ownership and permission bits set correctly, using the chown and chmod commands, respectively. (In a few exotic cases, other factors come into play, such as SELinux, AppArmor, filesystem ACLs, or network filesystem credential mapping. As I said, though, such situations are highly unlikely to apply to you.)

To answer the rest of your question… yes, you can see for yourself how it fails. As root, you can temporarily become another user, and you can do it without knowing that user's password — just run /bin/su - username. That will execute a shell with as the other user, as if you had logged in using that username and password. When you're done with that shell, exit it, and you will drop back into your original root shell.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.