2

I am using CentOS 5.4 in our office and I want to block the /etc partion for users whose UID and GID more than 100 or 500. How can I do this?

Improve this question
3
  • And here your title gives the impression that you're striving for security, not paranoia.
    – Ignacio Vazquez-Abrams
    Jun 4, 2010 at 7:04
  • 3
    /etc should be accessible to every user, it could lead to undefined behavior of applications relying on the files inside. Think of /etc/passwd or profiles for the shell which should be sourced.
    – Bram Schoenmakers
    Jun 4, 2010 at 7:43
  • Save yourself time -- don't bother creating any of those user accounts.
    – jscott
    Jun 4, 2010 at 12:36

4 Answers 4

Reset to default
11

If you do that, users will not be able to do anything worthwhile on that machine. You may as well just disable their logins.

In short, don't do it

What are you really wanting to achieve by doing this? If you post that people may be able to give you more sensible solutions.

Improve this answer
0

You cant block /etc otherwise people are not able to log into the system. One thing you could look into is dropping your users into a chrooted environment but this seems like a little over kill, If your users are logging into the system with non privileged accounts then all they can do is look at the scripts/configs and not alter them.

What is your reasoning behind wanting to block access to /etc?

Improve this answer
0

Ordinarily most of /etc should all be read-only for most users, with a handful of files only readable by root-level accounts. If you've an otherwise secure machine then there's no reason to deny read access to /etc, and indeed it will break things as others have mentioned.

If there are specific files you want to deny read access to then that's a different matter. It's probably wise to deny access to files which contain passwords, or other interesting data which you don't want being common knowledge. These kind of files would be accessed by root or a system account, and so you can deny access to ordinary users.

Improve this answer
0

Doing that is the equivalent of stopping windows users from getting to the system32 directory. It will not be good.

Improve this answer

You must log in to answer this question.