Proper way of creating users and restricting permissions?
Clash Royale CLAN TAG#URR8PPP up vote
0
down vote
favorite
I want to create a user, allocate a home directory to the user and restrict their rwx permissions such that they can only stay/view the home directory. I want to hide /etc/apache2 and /var/www mainly.
I've tried:
useradd newuser
groupadd newgroup
usermod -g newgroup newuser
chmod g+rwx /home/newuser
chgrp -R /home/newuser
And it all seems well, but when I su newuser, I get bash: /etc/bash.bashrc: Permission denied, and it'd probably mean other applications probably will suffer also. So what is the proper way to achieve what I need?
Note: this is for a server, so no GUI and the newuser will require ssh access (at least).
bash permissions users groups
asked Apr 26 at 11:50
anonymous frog
1
add a comment |Â
up vote
0
down vote
favorite
I want to create a user, allocate a home directory to the user and restrict their rwx permissions such that they can only stay/view the home directory. I want to hide /etc/apache2 and /var/www mainly.
I've tried:
useradd newuser
groupadd newgroup
usermod -g newgroup newuser
chmod g+rwx /home/newuser
chgrp -R /home/newuser
And it all seems well, but when I su newuser, I get bash: /etc/bash.bashrc: Permission denied, and it'd probably mean other applications probably will suffer also. So what is the proper way to achieve what I need?
Note: this is for a server, so no GUI and the newuser will require ssh access (at least).
bash permissions users groups
asked Apr 26 at 11:50
anonymous frog
1
Not really, I couldsetfacl -R -m u:newuser:--- /var/wwwfor every directory that I want hidden. It's just not clean and not exactly future proof.
– anonymous frog
Apr 26 at 12:04
chgrp -R /home/newuseris missing the group argument. Depending on what the user should be able to do, they will need access to files outside of their home directory. But I don't understand how the commands you listed above would prevent the user from accessing/bin/bashor/etc/bash.bashrc, since both files (and their folders) should have appropriate read/execute permissions forothers. Have you changed any file permissions except for/home/newuser?
– danzel
Apr 26 at 12:20
My point was, anyone with admin privileges can reversesetfaclor whatever you use to restrict access.
– user68186
Apr 26 at 13:56
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I want to create a user, allocate a home directory to the user and restrict their rwx permissions such that they can only stay/view the home directory. I want to hide /etc/apache2 and /var/www mainly.
I've tried:
useradd newuser
groupadd newgroup
usermod -g newgroup newuser
chmod g+rwx /home/newuser
chgrp -R /home/newuser
And it all seems well, but when I su newuser, I get bash: /etc/bash.bashrc: Permission denied, and it'd probably mean other applications probably will suffer also. So what is the proper way to achieve what I need?
Note: this is for a server, so no GUI and the newuser will require ssh access (at least).
bash permissions users groups
asked Apr 26 at 11:50
anonymous frog
1
I want to create a user, allocate a home directory to the user and restrict their rwx permissions such that they can only stay/view the home directory. I want to hide /etc/apache2 and /var/www mainly.
I've tried:
useradd newuser
groupadd newgroup
usermod -g newgroup newuser
chmod g+rwx /home/newuser
chgrp -R /home/newuser
And it all seems well, but when I su newuser, I get bash: /etc/bash.bashrc: Permission denied, and it'd probably mean other applications probably will suffer also. So what is the proper way to achieve what I need?
Note: this is for a server, so no GUI and the newuser will require ssh access (at least).
bash permissions users groups
asked Apr 26 at 11:50
anonymous frog
1
asked Apr 26 at 11:50
anonymous frog
1
asked Apr 26 at 11:50
anonymous frog
1
asked Apr 26 at 11:50
anonymous frog
1
1
Not really, I couldsetfacl -R -m u:newuser:--- /var/wwwfor every directory that I want hidden. It's just not clean and not exactly future proof.
– anonymous frog
Apr 26 at 12:04
chgrp -R /home/newuseris missing the group argument. Depending on what the user should be able to do, they will need access to files outside of their home directory. But I don't understand how the commands you listed above would prevent the user from accessing/bin/bashor/etc/bash.bashrc, since both files (and their folders) should have appropriate read/execute permissions forothers. Have you changed any file permissions except for/home/newuser?
– danzel
Apr 26 at 12:20
My point was, anyone with admin privileges can reversesetfaclor whatever you use to restrict access.
– user68186
Apr 26 at 13:56
add a comment |Â
Not really, I couldsetfacl -R -m u:newuser:--- /var/wwwfor every directory that I want hidden. It's just not clean and not exactly future proof.
– anonymous frog
Apr 26 at 12:04
chgrp -R /home/newuseris missing the group argument. Depending on what the user should be able to do, they will need access to files outside of their home directory. But I don't understand how the commands you listed above would prevent the user from accessing/bin/bashor/etc/bash.bashrc, since both files (and their folders) should have appropriate read/execute permissions forothers. Have you changed any file permissions except for/home/newuser?
– danzel
Apr 26 at 12:20
My point was, anyone with admin privileges can reversesetfaclor whatever you use to restrict access.
– user68186
Apr 26 at 13:56
Not really, I could
setfacl -R -m u:newuser:--- /var/www for every directory that I want hidden. It's just not clean and not exactly future proof.– anonymous frog
Apr 26 at 12:04
Not really, I could
setfacl -R -m u:newuser:--- /var/www for every directory that I want hidden. It's just not clean and not exactly future proof.– anonymous frog
Apr 26 at 12:04
chgrp -R /home/newuser is missing the group argument. Depending on what the user should be able to do, they will need access to files outside of their home directory. But I don't understand how the commands you listed above would prevent the user from accessing /bin/bash or /etc/bash.bashrc, since both files (and their folders) should have appropriate read/execute permissions for others. Have you changed any file permissions except for /home/newuser?– danzel
Apr 26 at 12:20
chgrp -R /home/newuser is missing the group argument. Depending on what the user should be able to do, they will need access to files outside of their home directory. But I don't understand how the commands you listed above would prevent the user from accessing /bin/bash or /etc/bash.bashrc, since both files (and their folders) should have appropriate read/execute permissions for others. Have you changed any file permissions except for /home/newuser?– danzel
Apr 26 at 12:20
My point was, anyone with admin privileges can reverse
setfacl or whatever you use to restrict access.– user68186
Apr 26 at 13:56
My point was, anyone with admin privileges can reverse
setfacl or whatever you use to restrict access.– user68186
Apr 26 at 13:56
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1028383%2fproper-way-of-creating-users-and-restricting-permissions%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Not really, I could
setfacl -R -m u:newuser:--- /var/wwwfor every directory that I want hidden. It's just not clean and not exactly future proof.– anonymous frog
Apr 26 at 12:04
chgrp -R /home/newuseris missing the group argument. Depending on what the user should be able to do, they will need access to files outside of their home directory. But I don't understand how the commands you listed above would prevent the user from accessing/bin/bashor/etc/bash.bashrc, since both files (and their folders) should have appropriate read/execute permissions forothers. Have you changed any file permissions except for/home/newuser?– danzel
Apr 26 at 12:20
My point was, anyone with admin privileges can reverse
setfaclor whatever you use to restrict access.– user68186
Apr 26 at 13:56