How can I prevent unprivileged users from accessing /etc/passwd, /etc/group, etc
Clash Royale CLAN TAG#URR8PPP up vote
0
down vote
favorite
As the title suggests, I have a multi user environment, and in the interest of protecting privacy, I'd really like to be able to restrict users access to some of these publicly viewable files that give away info about other users.
If I restrict access to /etc/passwd with 0640, things stop working for that user.
If I add that user to a restrictive ACL, things stop working for that user.
I'd really like to avoid kicking unprivileged-users in to a jail if I can. I just want user privacy to be respected on a shared server. Any ideas?
permissions users groups passwd-file
asked Jun 1 at 23:47
Jack_Hu
56115
 |Â
show 2 more comments
up vote
0
down vote
favorite
As the title suggests, I have a multi user environment, and in the interest of protecting privacy, I'd really like to be able to restrict users access to some of these publicly viewable files that give away info about other users.
If I restrict access to /etc/passwd with 0640, things stop working for that user.
If I add that user to a restrictive ACL, things stop working for that user.
I'd really like to avoid kicking unprivileged-users in to a jail if I can. I just want user privacy to be respected on a shared server. Any ideas?
permissions users groups passwd-file
asked Jun 1 at 23:47
Jack_Hu
56115
I don't quite understand what privacy you wish to protect. "Hubert is in the Fancy group" doesn't seem personal or useful. Can you please clarify a bit?
– user535733
Jun 2 at 3:29
2
as mentioned in serverfault.com/questions/154345/… these files have to be readable.
– Wiglaf Pimwick
Jun 2 at 5:11
@user535733 - For example, my intention was to use a clients domain name on a web server, as their username. So,jesus-is-our-saviour--com, ormilfs-like-to-have-fun--net, etc... If clients can justless /etc/passwdand see that other clients we're dealing with don't fit with their morals, then it could cost clients, alternatively, competitors could get an account to simply see our client list... I guess I'll have to look at another naming scheme for clients? Unless there's any other ideas?
– Jack_Hu
Jun 2 at 12:35
Use docker and give each client a separate vm
– Panther
Jun 4 at 0:56
@Panther - I'm not sure what you mean. Docker creates containers that sit on top of the kernel. VM's are self contained computers, which mean having an individual OS, libraries, applications, configurations, etc., all running, which will not only take up a lot of storage resources, but also a lot of system resources, and be a nightmare to monitor and maintain.
– Jack_Hu
Jun 4 at 13:33
 |Â
show 2 more comments
up vote
0
down vote
favorite
up vote
0
down vote
favorite
As the title suggests, I have a multi user environment, and in the interest of protecting privacy, I'd really like to be able to restrict users access to some of these publicly viewable files that give away info about other users.
If I restrict access to /etc/passwd with 0640, things stop working for that user.
If I add that user to a restrictive ACL, things stop working for that user.
I'd really like to avoid kicking unprivileged-users in to a jail if I can. I just want user privacy to be respected on a shared server. Any ideas?
permissions users groups passwd-file
asked Jun 1 at 23:47
Jack_Hu
56115
As the title suggests, I have a multi user environment, and in the interest of protecting privacy, I'd really like to be able to restrict users access to some of these publicly viewable files that give away info about other users.
If I restrict access to /etc/passwd with 0640, things stop working for that user.
If I add that user to a restrictive ACL, things stop working for that user.
I'd really like to avoid kicking unprivileged-users in to a jail if I can. I just want user privacy to be respected on a shared server. Any ideas?
permissions users groups passwd-file
asked Jun 1 at 23:47
Jack_Hu
56115
asked Jun 1 at 23:47
Jack_Hu
56115
asked Jun 1 at 23:47
Jack_Hu
56115
asked Jun 1 at 23:47
Jack_Hu
56115
56115
I don't quite understand what privacy you wish to protect. "Hubert is in the Fancy group" doesn't seem personal or useful. Can you please clarify a bit?
– user535733
Jun 2 at 3:29
2
as mentioned in serverfault.com/questions/154345/… these files have to be readable.
– Wiglaf Pimwick
Jun 2 at 5:11
@user535733 - For example, my intention was to use a clients domain name on a web server, as their username. So,jesus-is-our-saviour--com, ormilfs-like-to-have-fun--net, etc... If clients can justless /etc/passwdand see that other clients we're dealing with don't fit with their morals, then it could cost clients, alternatively, competitors could get an account to simply see our client list... I guess I'll have to look at another naming scheme for clients? Unless there's any other ideas?
– Jack_Hu
Jun 2 at 12:35
Use docker and give each client a separate vm
– Panther
Jun 4 at 0:56
@Panther - I'm not sure what you mean. Docker creates containers that sit on top of the kernel. VM's are self contained computers, which mean having an individual OS, libraries, applications, configurations, etc., all running, which will not only take up a lot of storage resources, but also a lot of system resources, and be a nightmare to monitor and maintain.
– Jack_Hu
Jun 4 at 13:33
 |Â
show 2 more comments
I don't quite understand what privacy you wish to protect. "Hubert is in the Fancy group" doesn't seem personal or useful. Can you please clarify a bit?
– user535733
Jun 2 at 3:29
2
as mentioned in serverfault.com/questions/154345/… these files have to be readable.
– Wiglaf Pimwick
Jun 2 at 5:11
@user535733 - For example, my intention was to use a clients domain name on a web server, as their username. So,jesus-is-our-saviour--com, ormilfs-like-to-have-fun--net, etc... If clients can justless /etc/passwdand see that other clients we're dealing with don't fit with their morals, then it could cost clients, alternatively, competitors could get an account to simply see our client list... I guess I'll have to look at another naming scheme for clients? Unless there's any other ideas?
– Jack_Hu
Jun 2 at 12:35
Use docker and give each client a separate vm
– Panther
Jun 4 at 0:56
@Panther - I'm not sure what you mean. Docker creates containers that sit on top of the kernel. VM's are self contained computers, which mean having an individual OS, libraries, applications, configurations, etc., all running, which will not only take up a lot of storage resources, but also a lot of system resources, and be a nightmare to monitor and maintain.
– Jack_Hu
Jun 4 at 13:33
I don't quite understand what privacy you wish to protect. "Hubert is in the Fancy group" doesn't seem personal or useful. Can you please clarify a bit?
– user535733
Jun 2 at 3:29
I don't quite understand what privacy you wish to protect. "Hubert is in the Fancy group" doesn't seem personal or useful. Can you please clarify a bit?
– user535733
Jun 2 at 3:29
2
2
as mentioned in serverfault.com/questions/154345/… these files have to be readable.
– Wiglaf Pimwick
Jun 2 at 5:11
as mentioned in serverfault.com/questions/154345/… these files have to be readable.
– Wiglaf Pimwick
Jun 2 at 5:11
@user535733 - For example, my intention was to use a clients domain name on a web server, as their username. So,
jesus-is-our-saviour--com, or milfs-like-to-have-fun--net, etc... If clients can just less /etc/passwd and see that other clients we're dealing with don't fit with their morals, then it could cost clients, alternatively, competitors could get an account to simply see our client list... I guess I'll have to look at another naming scheme for clients? Unless there's any other ideas?– Jack_Hu
Jun 2 at 12:35
@user535733 - For example, my intention was to use a clients domain name on a web server, as their username. So,
jesus-is-our-saviour--com, or milfs-like-to-have-fun--net, etc... If clients can just less /etc/passwd and see that other clients we're dealing with don't fit with their morals, then it could cost clients, alternatively, competitors could get an account to simply see our client list... I guess I'll have to look at another naming scheme for clients? Unless there's any other ideas?– Jack_Hu
Jun 2 at 12:35
Use docker and give each client a separate vm
– Panther
Jun 4 at 0:56
Use docker and give each client a separate vm
– Panther
Jun 4 at 0:56
@Panther - I'm not sure what you mean. Docker creates containers that sit on top of the kernel. VM's are self contained computers, which mean having an individual OS, libraries, applications, configurations, etc., all running, which will not only take up a lot of storage resources, but also a lot of system resources, and be a nightmare to monitor and maintain.
– Jack_Hu
Jun 4 at 13:33
@Panther - I'm not sure what you mean. Docker creates containers that sit on top of the kernel. VM's are self contained computers, which mean having an individual OS, libraries, applications, configurations, etc., all running, which will not only take up a lot of storage resources, but also a lot of system resources, and be a nightmare to monitor and maintain.
– Jack_Hu
Jun 4 at 13:33
 |Â
show 2 more comments
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1042792%2fhow-can-i-prevent-unprivileged-users-from-accessing-etc-passwd-etc-group-etc%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
I don't quite understand what privacy you wish to protect. "Hubert is in the Fancy group" doesn't seem personal or useful. Can you please clarify a bit?
– user535733
Jun 2 at 3:29
2
as mentioned in serverfault.com/questions/154345/… these files have to be readable.
– Wiglaf Pimwick
Jun 2 at 5:11
@user535733 - For example, my intention was to use a clients domain name on a web server, as their username. So,
jesus-is-our-saviour--com, ormilfs-like-to-have-fun--net, etc... If clients can justless /etc/passwdand see that other clients we're dealing with don't fit with their morals, then it could cost clients, alternatively, competitors could get an account to simply see our client list... I guess I'll have to look at another naming scheme for clients? Unless there's any other ideas?– Jack_Hu
Jun 2 at 12:35
Use docker and give each client a separate vm
– Panther
Jun 4 at 0:56
@Panther - I'm not sure what you mean. Docker creates containers that sit on top of the kernel. VM's are self contained computers, which mean having an individual OS, libraries, applications, configurations, etc., all running, which will not only take up a lot of storage resources, but also a lot of system resources, and be a nightmare to monitor and maintain.
– Jack_Hu
Jun 4 at 13:33