Restricting certain commands. 1

[jxfish2]

Is there a way to restrict a specific user from executing certain specific commands?

Rksh doesn't seem to be the answer, as these users do need to change directories, and they will need to run most unix commands un-restricted...

I just don't want these users to be able to execute a few very specific commands...

TIA

Jxfish2

 

[PHV]

Write fake command with the same name in a directory, say /u/mycmd, and modify these user's profile with something like this:

PATH=/u/mycmd:$PATH

Or, if in ksh, play with the

alias

builtin.
You may also consider

sudo

.

Hope This Help, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884

 

[jxfish2]

But, what's to stop the user from changing their PATH statement from the command line?

All of my users are pretty computer savvy professionals...

I need something more bullet-proof...

Something that they can't modify from the command line...

Something like a restricted shell, or something like an ACL change, restricted specifically by UserID, and not UID...

I have some super-users that are effectively root, yet have their own "su -" accounts...

They login to these "su -" accounts via sudo... There is no direct login to these accounts...

I want to restrict them from issuing certain commands, without hindering their ability to do the real work they need to do...

Jxfish2

 

[PHV]

So you want to restrict rights of super-users ?

 

[jxfish2]

Yes...

I don't want users with a LoginID other than root to use the "su" command...

All users will access the servers via their plain userID, then using 'sudo', they can "su" to their super-user account...

Once there, I do not want them to be able to further "su" to any other accounts, nor do I want them to be able to telnet or rlogin to any of the other servers in our environment...

And, I don't want them to be able to modify / "vi" certain files, especially those files which set the rules to begin with...

So, what I need, is the ability to specifically deny certain commands or actions...

The list of what they need to do is too great to try specifically enabling those commands...

Is there a way to do this?

For example:

The command "whoami" returns their actual LoginID, while the command "id" returns their effective LoginID...

I need a way to restrict commands, by the actual LoginID, and not the effective LoginID...

 

[Deleted]

You will have to set-up a jail for the user.

http://sourceforge.net/projects/jail

M. Brooks
X Concepts LLC

http://xconcepts.com

 

[jxfish2]

Thanks, I just took a quick look at the link...

I'll research it a little more tomorrow...

Have a great day...

Jxfish2

 

[chipperMDW]

Normally:

1. Make the restricted commands executable only by root, then make users use sudo to run the commands.

2. Make the restricted commands executable only by members of a certain group, and keep restricted users out of that group.


But what's the point if they can become superuser? The superuser can, by definition on most systems, do anything.


If you set up a jail, they can only deal with what's in the jail, not the rest of your system.

 

[jxfish2]

I need to find out more about "jail"...

I want to explicitly deny access to certain commands...

 

[PHV]

I want to explicitly deny access to certain commands
Backup them on a floppy and then remove them from the system.
Sorry for the bad joke

Hope This Help, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884

 

[aigles]

You can use ACLs to restrict access to commands if your Unix supports them.

Jean Pierre.

 

[PHV]

Jean-Pierre, how you restrict access to Super-Users ?

 

[aigles]

No way if a Super-User is a root user ...
If Super-User can restrict access to another Super-User, a Super-User can remove those restrictions.



Jean Pierre.

 

[dsanchez2]

A super-user cannot be restricted. Any restriction that you try to impose on a super-user account can be undone.

You need to re-think what you want to achive. What you need to do is identify the commands for which these users require super-user privilege. Then you should be able to grant them access to just these commands with super-user privilege (by using the set-uid facility). However, you will need to be very carefull when doing this: Care should be taken that only the selected users can execute these privilege commands, and that the commands do not allow the users to obtain unrestricted super-user access (for example you would not use this method on a shell or any command that spawns a shell, like vi).

 

[markus38]

IBM produce a product call AMOS, access manager for operating systems, you can use this to restrict access to files, executables, directories etc...
There is a similar product that runs under Solaris called pitbull I believe and ...
There is a LINUX project known as LIDs

http://www.lids.org

that is also in the same area...