0

On Windows it is possible to "hide" contents of the drive, system folders from unprivileged users and let them only access files from their user directory. In this case even when users do File/Open they only see their user directories.

Is there any way to achieve the same on Linux? So that when user logs in to remote server he is only able to access his own files.

UPDATE: On remote server users can run GUI applications. Ultimate goal is to prevent them from seeing system internals in File/Open and the like and also prevent them from accessing, say, /etc/passwd if they type in full path to that file.

Improve this question
2
  • 1
    "hiding" files and only allowing people to access their own files are two different and unrelated things. It might be worth clarifying exactly what you're after.
    – Rob Moir
    Mar 5, 2012 at 8:34
  • They are related at least in my case. I've updated the question. Thanks!
    – Dima Malenko
    Mar 5, 2012 at 11:51

4 Answers 4

Reset to default
5

Short answer is no. In order for the user to interact with their data they need to use programs (bash, ls, cat, vi....). In order to use these programs the user must be able to list the directories they are contained within and read from the files which contain the programs.

You can prevent users from accessing other users data files by settings the permissions (and permissions mask) appropriately and/or restricting the access via chroot (but they can still see the config and executable files they have access to).

Ultimate goal is to prevent them from seeing system internals in File/Open

This is somewhat meaningless as an Ultimate goal - what is the threat model? How could they gain / subvert the security by doing so?

Improve this answer
1
  • I was generally thinking along the same lines, but hoped there might be something I did not see. As for hiding system internals, it is not a security measure, but more a convenience feature. After all, Windows does that and it comes in handy. Thanks!
    – Dima Malenko
    Mar 6, 2012 at 18:52
3

You can 'chroot' users in their homedirs (they can't go upper their homedir and see anything else). You can check the permissions to block access to users in a special group (but most of the system utilities continue to work as they needed by users). In this last case, you don't have logs (but are they necessary as you know that your users cant see files ?)

Improve this answer
1

If the users log in using ssh, you could "chroot" them to their home directories. OpenSSH v4.9p1 allows you to to this using the ChrootDirectory directive : 

Match group sftponly
         ChrootDirectory /home/%u
         X11Forwarding no
         AllowTcpForwarding no

(See man sshd_config for more details)

Depending on the level of trust you have for the users, you may also want to use a restricted shell like lshell or rbash.

Improve this answer
1

You can achieve this with rbash

Use this command to make a new user named guest, who only has access to their home directory:

sudo useradd -m -s /bin/rbash guest

Breakdown:

  • sudo useradd creates a user with root permissions
  • -m creates and registers a home directory for the user
  • -s sets the user's shell. in our case, the rbash directory
  • /bin/rbash the path of the rbash directory
  • guest name of our user

This should be the result: LINK

Improve this answer
1
  • Please don't post screenshots of text. Copy the text into your post instead, so it's readable by screen readers and search engines.
    – Andrew Schulman
    Apr 29, 2021 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .