How to restrict a linux user to be only able to read /home/user and nothing else

Question

Hi,

I need to create a special linux user account that has a very limited set of permissions on the system. Essentially to have read-only permissions for his home dir (and sub dirs) and nothing else - i.e. this user has no write or execute permissions and should not be able to read/access other user dirs or indeed anything outside of his home directory, irrespective of rwx permissions.

What thoughts do stackers have on the easiest way to do this?

Thanks,

Richard.

Answer 1

• use a special restricted shell
• chroot the user into a minimal environment
• use SE Linux

Answer 2

You might need to make use of setfacl as given in

http://www.cs.unc.edu/cgi-bin/howto?howto=linux-file-acls

http://www.vanemery.com/Linux/ACL/linux-acl.html

Best of luck.

Answer 3

If the user can't execute anything or write any files, why give them interactive access at all?

You might as well just give them a password protected web-interface into their directory.

Answer 4

The user needs read permissions on certain commands and directories to do anything at all once logged in. So basically, you can't do it.

Maybe you should explain the real problem you are trying to solve by attempting to do this?

Answer 5

The user will need read/execute rights to execute any command (ls, login shell, etc), so you can't easily take all rights away.

Usually it's enough to make sure they can't mess with the home directories of other users. To do this, put the user into a new group (like "untrusted"), chown his home directory and revoke the group and other rights on all home directories: chmod go-rwx /home/*/

If that is not enough, create a chroot jail. This is basically a mini Linux where nothing outside a certain directory (the jail) is visible (or accessible). Jailkit might help you to set this up.

Answer 6

I guess you can just don't create any home folder...

Answer 7

If you are worried about remote access and that is the main reason to lock the account down you might want to just add them to a list of banned ssh users.

Answer 8

It sort of sounds like you are trying to set up a place for someone to pick up files and the like. If so, may I suggest creating an ftp or sftp account rather than a regular user account. In addition to being an easy way for the user to get files, it ought to take care of most of the security issues your worried about.

Talk to your system administrator.