How to create a read-only account?

[JTan]

Hi,

is it possible to create a read-only account by adding some features in the /etc/passwd entry or we just have to add the user to a specific group and provide the group with only read access?

How about creating a ftp-only a/c?

Sorry, this may sound silly but I need to know more about the procedures.

Thanks!

 

[dUbbsNIX]

Need a bit more info, read-only access to what? Specific files or filesystems, or application?

You'll need to use RBAC or native access control e.g. group membership. There are no options in /etc/passwd or /etc/shadow that will allow you to do this.

Dubbs.

 

[JTan]

I am referring to files now but I don't mind knowing the ways to filesystems as well.

 

[blainepruitt]

Depending on the version of Solaris you are using I believe under the /etc/passwd you can use /bin/ftponly. You may want to do some reading on Sun's site but I vaguely remember some configuration such as that.

Sorry I couldn't be of more help.

-BP

 

[SamBones]

To make an FTP only account, create a normal user account, but make the default shell be [tt]/usr/bin/false[/tt]. Then, if you have a file [tt]/etc/shells[/tt], add [tt]/usr/bin/false[/tt] to it.

That's it!

This will allow an FTP in to the account, but you won't be able to log in or even [tt]su[/tt] to it.

Hope this helps.

 

[SamBones]

Depending on how you want to "control" the user, you should look into the commands [tt]chroot[/tt] and [tt]/usr/lib/rsh[/tt]. That [tt]rsh[/tt] is the restricted shell, not the remote shell. There's also a Korn shell version called [tt]rksh[/tt]. For more info on it...
[tt]
man -s1m rsh
[/tt]
Hope this helps.

 

[JTan]

Hi dUbbsNIX,

how shld I go abt using RBAC? What action shld I include in the exec file?

 

[SamBones]

I could be wrong, but I don't believe you can restrict a user id to do less using RBAC. The roles created in RBAC are for granting specific privileges or commands to users. It's to let a user do more, not restrict them to do less.

Hope this helps.

 

[dUbbsNIX]

I respectivley disagree with SamBones to an extent re. RBAC

It is true you use RBAC to prevent direct login, and grant abilties to user accounts, however the correct configuration would obviously you to disallow these abilties to certain users by virtue of obmission.

Make sense?