Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using CentOS 5.4 in our office and I want to block the /etc partion for users whose UID and GID more than 100 or 500. How can I do this?

share|improve this question
    
And here your title gives the impression that you're striving for security, not paranoia. –  Ignacio Vazquez-Abrams Jun 4 '10 at 7:04
3  
/etc should be accessible to every user, it could lead to undefined behavior of applications relying on the files inside. Think of /etc/passwd or profiles for the shell which should be sourced. –  Bram Schoenmakers Jun 4 '10 at 7:43
    
Save yourself time -- don't bother creating any of those user accounts. –  jscott Jun 4 '10 at 12:36
add comment

4 Answers

If you do that, users will not be able to do anything worthwhile on that machine. You may as well just disable their logins.

In short, don't do it

What are you really wanting to achieve by doing this? If you post that people may be able to give you more sensible solutions.

share|improve this answer
add comment

You cant block /etc otherwise people are not able to log into the system. One thing you could look into is dropping your users into a chrooted environment but this seems like a little over kill, If your users are logging into the system with non privileged accounts then all they can do is look at the scripts/configs and not alter them.

What is your reasoning behind wanting to block access to /etc?

share|improve this answer
add comment

Ordinarily most of /etc should all be read-only for most users, with a handful of files only readable by root-level accounts. If you've an otherwise secure machine then there's no reason to deny read access to /etc, and indeed it will break things as others have mentioned.

If there are specific files you want to deny read access to then that's a different matter. It's probably wise to deny access to files which contain passwords, or other interesting data which you don't want being common knowledge. These kind of files would be accessed by root or a system account, and so you can deny access to ordinary users.

share|improve this answer
add comment

Doing that is the equivalent of stopping windows users from getting to the system32 directory. It will not be good.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.