Re: Limiting User Commands

From: Doug Griswold (griswld_at_cio.sc.gov)
Date: 11/05/04

  • Next message: Joseph: "[CONFUSED NEWBIE] Cron" 
    Date: Fri, 05 Nov 2004 12:57:15 -0500
To: <zeroion@gmail.com>, <debian-isp@lists.debian.org>, <debian-user@lists.debian.org>

    Take a look at sudo.

    >>> Stephen Le <zeroion@gmail.com> 11/5/2004 12:31:21 PM >>>
    Hello all,

    Is there an easy way to limit the commands a certain group of users
    can execute? I've looked at chroot, and it's too complicated for my
    needs and seems too easy to circumvent; users will be able to upload
    their own Perl scripts, so it seems that they'll be able to access
    commands outside their chroot by getting Apache w/ mod_perl to execute
    the script.

    I'd like to be able to compile a list of commands/programs that users
    in a certain group will be able to execute (ex. cp, mv, rm, etc).
    However, I'd also be happy to compile a list of commands users
    shouldn't be able to execute. In regards to the latter method, would
    it be possible for me to change the group ownership of the commands I
    don't want users to have access to and revoke execute permission from
    that group?

    Thanks,
    Stephen Le 

    -- 
To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org 
-- 
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
  • Next message: Joseph: "[CONFUSED NEWBIE] Cron"

    Relevant Pages

    • [UNIX] Vulnerabilities Found in Scponly
      ... SSHd environment files. ... the user can upload a file with a custom ... This provides the user with a means of running arbitrary commands ... the user could execute arbitrary commands by uploading ...
      (Securiteam)
    • Re: Limiting User Commands
      ... >> Is there an easy way to limit the commands a certain group of users ... A chroot would only apply to a user if they were logged into ... they wouldn't be able to execute it. ... Perl scripts and get Apache to execute them without restriction - the ...
      (Debian-User)
    • Re: [Full-disclosure] FWD Cisco IOS Remote Command Execution Vulnerability
      ... > Vulnerability Alert Cisco IOS Remote Command Execution ... > 9.4 Last Change Cisco has responded to this issue; ... > prone to an issue that may permit gay people to execute arbitrary ... > commands from a password prompt. ...
      (Full-Disclosure)
    • Dont mind if I grouse on some basic topics?? (very long)
      ... I know as experienced programmers you really don't want to hear people gripe ... and moan about basic, indeed critical topics, but I just have to vent on ... commands within a set sequence. ... doesn't appear to uniformly execute them. ...
      (comp.windows.x)
    • Re: Limiting User Commands
      ... > Is there an easy way to limit the commands a certain group of users ... > in a certain group will be able to execute (ex. ... Use of chroot with bash started as rbash sems to be what you need. ...
      (Debian-User)