Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I disable any kinds of remote control (SSH, X, NFS, SMB, ... what else?)
for a certain user?

Or, asked the other way round: How do I disable remote control
for all users except a certain one?

Is there a way to do it in one place?
(By placing the user in a certain group, or so)

share|improve this question
add comment

5 Answers

  • SSH uses usernames & passwords for authentication/authorization.
  • The NFS server uses IP addresses for mounting authentication/authorization and the user id when individual files are used (the regular Unix permissions are used). Also it can use other methods, like Kerberos. Anyway the idea is that mounting authorization is done per machine, not per user.
  • Samba uses usernames & passwords for mounting most of the time (security = user) and I think that CIFS also supports using UIDs when accessing individual files just like NFS. The usernames & passwords are usually stored in a file called passdb.tdb, not in /etc/shadow, so passwd doesn't change the password of a Samba user.
  • X uses IP addresses for authentication/authorization or cookies.

As you can see, there's no easy way to enable/disable access to these services for a specific user.

LE: A couple of network services including RPC (used by NFS) and SSH, use the *hosts_access* mechanism (man hosts_access) for host based authentication/authorization. You'll need to edit /etc/hosts.allow and /etc/hosts.deny for this. Compared to iptables, the advantage is that you don't need to know the ports of the services, but not all services support this mechanism. Paranoid people would use both :-)

LE2: *hosts_access* supports usernames too, but AFAIK this is insecure.

share|improve this answer
add comment

I'm not sure about SMB and NFS as I never use them. On my servers SSH is the only service available for remote access and I can limit their access with the AllowUser directive in sshd_config. With the latest versions of OpenSSH there is an internal sftp client (no external dependencies) which can be configured. This makes it relatively easy to set up a user with sftp access to a chroot'ed directory only--as when they need to update web content, etc.

Subsystem sftp internal-sftp

MatchUser Joe
  ForceCommand internal-sftp
  ChrootDirectory /var/www

the chroot dir and all above it must be:
* owned by root
* not group or other writable
share|improve this answer
add comment

You want to look into PAM: http://www.kernel.org/pub/linux/libs/pam/

Cheers

share|improve this answer
add comment

You can easily disable a user account with this command:

passwod <username> -l

And re-enable it with:

passwod <username> -u

Whether or not this is completely effective at blocking the user's access depends on what services you have running. But they will certainly be prevented from logging in.

share|improve this answer
    
Thank you, but I was hoping to find a permanent solution. The user should be able to do everything usual on that machine. Just not do anything remotely. –  ivan_ivanovich_ivanoff Aug 29 '09 at 14:38
1  
Your solution is ok, but it doesn't cover SSH public key authentication. –  Cristian Ciupitu Aug 29 '09 at 18:26
add comment

A restrictive IPTABLES firewall with default DROP would work rather effectively (don't forget to keep a hole for yourself and local host). ;-) Manually add the static IP of the "allowable" host(s) on a port by port basis. No IP provided no service. Note: This will not prevent tunnels to allowed ports for a allowed host. Also, as Cristian Ciuputu mentioned (up vote... ;-), samba has a "hosts allow" section, NFS has a range you export to, X forwarding can be disabled, and ssh can be blocked or denied.

share|improve this answer
    
Any suggestions, how to keep this hole? (No static IPs) –  ivan_ivanovich_ivanoff Aug 30 '09 at 8:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.