You're right, it's not an ideal solution, but based on my (quick) read of what he was looking for, the restricted shell sounded like what he's after.
It might not provide much protection against a sophisticated user, but it's useful for keeping casual or "single application" users from poking around or running programs they're not supposed to. > -----Original Message----- > From: Linux on 390 Port [mailto:[EMAIL PROTECTED] Behalf Of > Fargusson.Alan > Sent: Friday, May 20, 2005 11:41 AM > To: [email protected] > Subject: Re: [LINUX-390] Linux default permissions > > > The reason that restricted shells are not used much is that > they don't really enhance security. Not being able to cd to > /etc does not prevent someone from doing a 'cat /etc/passwd'. > The real answer to security is to set the permission bits on > directories that you want to protect, or if you needs are > more complicated use ACLs. > > -----Original Message----- > From: Linux on 390 Port [mailto:[EMAIL PROTECTED] Behalf Of > Hall, Ken (IDS DCS PE) > Sent: Friday, May 20, 2005 8:35 AM > To: [email protected] > Subject: Re: Linux default permissions > > > Chroot is a little extreme. It locks the user into a > completely isolated subset of the filesystem, which means he > has to have his own copies of any files he might need to run. > His PATH can't look outside the jail. This might be okay > for single-function daemons, but it could be a nightmare for > an interactive user (and the sysadmin). > > (I mentioned before) Bash has an option called "restricted > shell". It's a carryover from the old Bourne shell, and it > can be enabled either by the "-r" option, or by invoking the > (Bourne) shell as "rsh". In the case of Bash, you can use > "rbash", but you have to create a symlink for rbash pointing > to bash. For some reason, this isn't done in any of the > systems I looked at. > > A use in a restricted shell can't chdir below his initial > directory, but can access other directories via PATH. He > also can't change his PATH and certain other options set via > environment variables. > > > -----Original Message----- > > From: Linux on 390 Port [mailto:[EMAIL PROTECTED] Behalf Of > > McKown, John > > Sent: Friday, May 20, 2005 11:26 AM > > To: [email protected] > > Subject: Re: [LINUX-390] Linux default permissions > > > > > > See if the following gives you any ideas: > > > > http://www.tjw.org/chroot-login-HOWTO/ > > > > It appears, on first reading, to force a user into a "chroot > > jail" that > > consists of their home directory. > > > > > > -- > > John McKown > > Senior Systems Programmer > > UICI Insurance Center > > Information Technology > > -------------------------------------------------------- If you are not an intended recipient of this e-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute it. Click here for important additional terms relating to this e-mail. http://www.ml.com/email_terms/ -------------------------------------------------------- ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
