The only thing that's going to stop a knowledgable shell user from causing trouble is the security that's built into the OS, and that's only if it's set up properly. Even then, there are plenty of ways to cause trouble. Linux isn't zOS, and there are still ways to cripple THAT if you know what you're doing.
But this is a balancing act. You need to give the user just enough to be able to do his job without giving away the whole store. Sometimes that means a virtual server, sometimes it means a chroot jail (but that can be a nightmare to administer), and sometimes it means using the restricted shell, and maybe forcing the user into a menu-based environment (suitable for clerk-types who seem to be able to do more damage through ignorance than maliciousness). It sounded to me like what Tom is looking for is a way to have shell users forced to remain within their home directory structure, but still have access to the usual system commands. I THOUGHT the restricted shell would allow this, but I played with it a bit and it's actually TOO restrictive for his needs. > -----Original Message----- > From: Linux on 390 Port [mailto:[EMAIL PROTECTED] Behalf Of > Nix, Robert P. > Sent: Friday, May 20, 2005 11:53 AM > To: [email protected] > Subject: Re: [LINUX-390] Linux default permissions > > > Don't confuse ignorance with security. The person you want to > stop will be the person that knows what you've done and how > to get around it. > > > -- > Robert P. Nix Mayo Foundation > RO-CE-8-857 200 First Street SW > 507-284-0844 Rochester, MN 55905 > ----- > "In theory, theory and practice are the same, but > in practice, theory and practice are different." > > -----Original Message----- > From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On > Behalf Of Hall, Ken (IDS DCS PE) > Sent: Friday, May 20, 2005 10:51 AM > To: [email protected] > Subject: Re: Linux default permissions > > You're right, it's not an ideal solution, but based on my > (quick) read of what he was looking for, the restricted shell > sounded like what he's after. > > It might not provide much protection against a sophisticated > user, but it's useful for keeping casual or "single > application" users from poking around or running programs > they're not supposed to. > > ---------------------------------------------------------------------- > For LINUX-390 subscribe / signoff / archive access instructions, > send email to [EMAIL PROTECTED] with the message: INFO > LINUX-390 or visit > http://www.marist.edu/htbin/wlvindex?LINUX-390 > -------------------------------------------------------- If you are not an intended recipient of this e-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute it. Click here for important additional terms relating to this e-mail. http://www.ml.com/email_terms/ -------------------------------------------------------- ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
