Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have directory called /backups which i have given access to one user. User can view the content via FTP as i have made the sym link in his home directory

But if user go up the directory then he can also see contents of / directory

How can I stop that?

share|improve this question

2 Answers 2

If the user is only accessing via FTP and you want to more strictly lock what they have access to, look into setting up a chroot jail for the user. The specifics of how to do that will vary depending on your FTP server, but you should be able to search around for the specific server you're using. Since this is tagged CentOS, I'll assume VSFTP, which is actually easy to chroot them to their home directory by specifying chroot_local_user=YES in the vsftpd.conf

If they are getting shell access, you can still chroot the user, but it gets more complicated because you have to replicate the environment they need in their chroot'ed jail. So if they need to run /usr/bin/tail, for example...that would have to live in /home/backupuser/usr/bin/tail, because they can't see the actual /usr/bin/tail. That goes for all the things taken for granted, like cd and ls too.

share|improve this answer

In short, you can't. By design going back to the 1970's, Unix systems require users to see the contents of /. They can't do anything at that level, but they can see it. Individual files may be set so they can't view them, and directories may be set so the users can't enter them, but the user will at least be able to get file and directory names. You'll just have to live with this.

share|improve this answer
    
what are main folders which i need to stop users from reading and executing . i means like boot , root and what permission should i set on them –  John Oct 13 '10 at 1:24
    
@Master, There permissions are pretty safe by default on pretty much any new install. –  Zoredache Oct 13 '10 at 6:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.