Koozali.org: home of the SME Server

Legacy Forums => Experienced User Forum => Topic started by: Smitro on March 31, 2005, 11:11:45 PM

Title: Lock Users to there Home Directory
Post by: Smitro on March 31, 2005, 11:11:45 PM

Hi,

I just noticed the other day that if a user logs in using SSH they are put straight into there home directory. But a simple "cd .." will take them down the tree and from there, they are off wondering the system. Is there anyway to stop them from leaving there home directory?

Title: Lock Users to there Home Directory
Post by: cc_skavenger on April 01, 2005, 01:53:27 AM

have you actually logged in with a username other than root or admin?  This is not allowed on a normal system.  Have you modified your system to give users shell access??  This is what I get when I use a regular username to login to my server over ssh:

Quote

-------------------------
Mitel Networks SME Server
-------------------------


Standard user login services have been disabled.


Terminating connection.

Title: Lock Users to there Home Directory
Post by: Smitro on April 01, 2005, 02:37:20 AM

Sorry, my bad. I used the following package which created a Sever manager panel to allow me to turn on and off certian users.

http://www.ibiblio.org/pub/Linux/distributions/smeserver/contribs/star/mitel/contrib/user-shell-access/

I enabled the user to be able to SSH, and said no to sudo. But the user is able to roam freely around the system now.

Title: Lock Users to there Home Directory
Post by: cc_skavenger on April 01, 2005, 03:23:02 AM

Locking a user into their home directory is called chroot(ing).  It is done with ftp so that the user can only login to their home directory.  I am not sure how to impliment this on the ssh level.

Title: Re: Lock Users to there Home Directory
Post by: CharlieBrady on April 01, 2005, 05:42:15 AM

Quote from: "Smitro"

I just noticed the other day that if a user logs in using SSH they are put straight into there home directory. But a simple "cd .." will take them down the tree and from there, they are off wondering the system.

They are restricted in what they can see and touch by normal file permission restrictions.

Quote

Is there anyway to stop them from leaving there home directory?

There wouldn't be much point in doing that. From their home directory they can access various other files using ftp, or smbclient, or http - just as they would be from another system  on the LAN.

If you don't want them to see other files on the system, don't add them to any of the groups which own those files.

Title: Re: Lock Users to there Home Directory
Post by: Smitro on April 01, 2005, 08:52:42 AM

Quote from: "CharlieBrady"

There wouldn't be much point in doing that. From their home directory they can access various other files using ftp, or smbclient, or http - just as they would be from another system  on the LAN.

Not true. My system is locked down so they can't.

Now tell me how to lock down ssh.

Title: Re: Lock Users to there Home Directory
Post by: CharlieBrady on April 01, 2005, 04:55:53 PM

Quote from: "Smitro"

Quote from: "CharlieBrady"

There wouldn't be much point in doing that. From their home directory they can access various other files using ftp, or smbclient, or http - just as they would be from another system  on the LAN.

Not true. My system is locked down so they can't.

You're quite sure of that? How do they run the ls command if they can't read the /bin/ls file?

Quote

Now tell me how to lock down ssh.

Sorry, I don't know the answer to that.

If you don't trust your users, don't give them access.

Title: Lock Users to there Home Directory
Post by: Smitro on April 02, 2005, 02:47:48 AM

what I'm saying is... All ports are blocked to the outside world, except web and secure web and email. I now want to allow access to ssh, but I don't want allow access to files other than what is in there home directory.

Guess it will have to go into the too hard basket.