phcolaris wrote:
On Thu, 2006-08-31 at 13:41 -0500, James Dickens wrote:
On 8/31/06, phcolaris <[EMAIL PROTECTED]> wrote:
hi folk,
I'm looking for a way how to keep users in their home directories - so
that SGD/Ray users can't go and see other users and the root file
system, simply not leave their /home/~ directory
I've been playing around with few options (eg SUDO,containers or jail),
but that isn't the right answer.
The only way I see that this could be done that is pseudo painless
other than directory permissions is have each user dumped into there
own Zone on a remote box, when they logged in, while they would have
access to other filesystems, it would only be a default install, no
other users files would be accessible. No changes could be made even
if they some how gained root because most of the files would be
readonly. Since the operating system is now free and opensource, they
would have complete access to this information anyway, they could just
install there own copy and or view the source at cvs.opensolaris.org.
To add an extra layer of protection you could start out with an
extremely minimal install of solaris on the machine with the zones on
it, then add only the applications the user would need to do his work.
No other applications or user information would be availible to them.
The other option is trusted Solaris 8 or trusted extensions to Solaris
express, I've never used either product but they are some of the most
secure OSes availible so it may be a possiblity of course there
security features may preclude it from being used with sunray clients,
i'm not sure.
James Dickens
uadmin.blogspot.com
thanks James,
I've been obviously considering zones/containers, but it would be
unmanageable with 100< users and require unnecessary resources.
I'm sure there is another, more elegant solution. Some companies has got
installations of SGD/Ray for thousands of customers/employees so they
would definitely have some nice user management in place which also
would take care of this aspect.
thank you
-philip
Please be cautious about bringing a PC bias to this problem.
Unix and Solaris in particular were designed from inception to be
multi-user safe and friendly. The whole suite of access perms,
ACLs, etc are designed to protect users from each other.
The problem with chroot is that it effectively eliminates the
ability to run system tools, which is not really appropriate for
end-users. You may be able work around this but it's kludgey.
Zones are more suitable, but as you point out heavy-weight for
a large user community. Unless you need users to have privileged
roles within zones this is probably unnecessary.
In recent times there has been a migration of users to single-user
environments, and we tend to forget that multi-user environments
are alive and well.
So in summary my only caution is to not over-constrain your solution.
There are clearly needs to sometimes provide extra protection between
user domains. I see this primarily between Corporate entities sharing
a single server, such as an ASP sort of environment, where the partitioning
is between Corporate user communities, not individual users. Zones
scales better at this level of granularity.
My 2c.
-Bob
These opinions are my own, not my employers.
_______________________________________________
SunRay-Users mailing list
[email protected]
http://www.filibeto.org/mailman/listinfo/sunray-users
