Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On Windows it is possible to "hide" contents of the drive, system folders from unprivileged users and let them only access files from their user directory. In this case even when users do File/Open they only see their user directories.

Is there any way to achieve the same on Linux? So that when user logs in to remote server he is only able to access his own files.

UPDATE: On remote server users can run GUI applications. Ultimate goal is to prevent them from seeing system internals in File/Open and the like and also prevent them from accessing, say, /etc/passwd if they type in full path to that file.

share|improve this question
    
"hiding" files and only allowing people to access their own files are two different and unrelated things. It might be worth clarifying exactly what you're after. –  RobM Mar 5 '12 at 8:34
    
They are related at least in my case. I've updated the question. Thanks! –  Dima Malenko Mar 5 '12 at 11:51

3 Answers 3

up vote 3 down vote accepted

Short answer is no. In order for the user to interact with their data they need to use programs (bash, ls, cat, vi....). In order to use these programs the user must be able to list the directories they are contained within and read from the files which contain the programs.

You can prevent users from accessing other users data files by settings the permissions (and permissions mask) appropriately and/or restricting the access via chroot (but they can still see the config and executable files they have access to).

Ultimate goal is to prevent them from seeing system internals in File/Open

This is somewhat meaningless as an Ultimate goal - what is the threat model? How could they gain / subvert the security by doing so?

share|improve this answer
    
I was generally thinking along the same lines, but hoped there might be something I did not see. As for hiding system internals, it is not a security measure, but more a convenience feature. After all, Windows does that and it comes in handy. Thanks! –  Dima Malenko Mar 6 '12 at 18:52

You can 'chroot' users in their homedirs (they can't go upper their homedir and see anything else). You can check the permissions to block access to users in a special group (but most of the system utilities continue to work as they needed by users). In this last case, you don't have logs (but are they necessary as you know that your users cant see files ?)

share|improve this answer

If the users log in using ssh, you could "chroot" them to their home directories. OpenSSH v4.9p1 allows you to to this using the ChrootDirectory directive :

Match group sftponly
         ChrootDirectory /home/%u
         X11Forwarding no
         AllowTcpForwarding no

(See man sshd_config for more details)

Depending on the level of trust you have for the users, you may also want to use a restricted shell like lshell or rbash.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.