I created a user which using the /bin/rbash, so it cannot execute some commands, like 'cd' and 'ls'. But it still can browser other directory when enter some path like '/bin/', then using tab the shell will show the files under 'bin'. And this user only allowed to login through serial port. How can I restrict the user only work in it's home dirctory, and not read other directories.
Doing a quick search I have found this couple of questions that I think may fit your requirements
Create ssh user which can only access home directory
Give user read/write access to only one directory
put
set disable-completion on
string in ~/.inputrc and restart your shell. it will disable completion at all.
this can solve my questions
It is possible to use chroot to implement a user that does not see other directories.
This might be quite crazy solution, and not recommended way to do it.
Create a script that makes chroot
#!/bin/sh
exec /usr/sbin/chroot /home/test /bin/sh
Use the script as login shell (/etc/passwd):
test:x:0:0:Linux User,,,:/:/usr/sbin/chrootsh.sh
Copy all needed files to home directory of the user. You need at least shell and libraries that are needed for the shell:
~ # ls -lR /home/test/
/home/test/:
total 2
drwxr-xr-x 2 root test 1024 Aug 21 13:54 bin
drwxr-xr-x 2 root test 1024 Aug 21 13:54 lib
/home/test/bin:
total 1776
-rwxr-xr-x 1 root test 908672 Aug 21 13:54 ls
-rwxr-xr-x 1 root test 908672 Aug 21 13:54 sh
/home/test/lib:
total 1972
-rwxr-xr-x 1 root test 134316 Aug 21 13:54 ld-linux.so.3
-rwxr-xr-x 1 root test 1242640 Aug 21 13:54 libc.so.6
-rwxr-xr-x 1 root test 640480 Aug 21 13:54 libm.so.6
~ #
Ready. Then login as the user:
~ # su - test
/ # pwd
/
/ # ls -lR /
/:
total 2
drwxr-xr-x 2 0 1000 1024 Aug 21 13:54 bin
drwxr-xr-x 2 0 1000 1024 Aug 21 13:54 lib
/bin:
total 1776
-rwxr-xr-x 1 0 1000 908672 Aug 21 13:54 ls
-rwxr-xr-x 1 0 1000 908672 Aug 21 13:54 sh
/lib:
total 1972
-rwxr-xr-x 1 0 1000 134316 Aug 21 13:54 ld-linux.so.3
-rwxr-xr-x 1 0 1000 1242640 Aug 21 13:54 libc.so.6
-rwxr-xr-x 1 0 1000 640480 Aug 21 13:54 libm.so.6
/ #
Related
When I run script as regular user manually, everything is OK. But if an email is received and piped into Go script, I can not open serial port because file does not exist.
postfix 1239 1025 0 13:20 ? 00:00:00 pipe -n watchParadox -t unix flags=F user=watch argv=/usr/local/bin/watch -paradox
watch 1240 1239 0 13:20 ? 00:00:00 /usr/local/bin/watch -paradox
Script is running under watch user who has been added to dialout group, postfix user, just to be sure, is in dialout also.
In my script I ran ls -la command to find out which files do truly exist:
drwxr-xr-x 6 root root 380 Feb 25 13:19 .
dr-xr-xr-x. 18 root root 4096 Feb 22 17:53 ..
lrwxrwxrwx 1 root root 11 Feb 25 13:19 core -> /proc/kcore
lrwxrwxrwx 1 root root 13 Feb 25 13:19 fd -> /proc/self/fd
crw-rw-rw- 1 root root 1, 7 Feb 25 13:19 full
drwxr-xr-x 2 root root 0 Feb 25 13:19 hugepages
lrwxrwxrwx 1 root root 28 Feb 25 13:19 log -> /run/systemd/journal/dev-log
drwxrwxrwt 2 root root 40 Feb 25 13:19 mqueue
crw-rw-rw- 1 root root 1, 3 Feb 25 13:19 null
lrwxrwxrwx 1 root root 8 Feb 25 13:19 ptmx -> pts/ptmx
drwxr-xr-x 2 root root 0 Feb 25 13:19 pts
crw-rw-rw- 1 root root 1, 8 Feb 25 13:19 random
drwxrwxrwt 2 root root 40 Feb 25 13:19 shm
lrwxrwxrwx 1 root root 15 Feb 25 13:19 stderr -> /proc/self/fd/2
lrwxrwxrwx 1 root root 15 Feb 25 13:19 stdin -> /proc/self/fd/0
lrwxrwxrwx 1 root root 15 Feb 25 13:19 stdout -> /proc/self/fd/1
crw-rw-rw- 1 root root 5, 0 Feb 25 13:19 tty
crw-rw-rw- 1 root root 1, 9 Feb 25 13:19 urandom
I am certain following file exists but is not shown when postfix pipe is executed.
crw-rw---- 1 root dialout 166, 0 25. úno 13.19 ttyACM0
I tried chmod 777 on the file but no luck in that department. Opening file via https://github.com/tarm/serial library which uses Go function:
os.OpenFile("ttyACM0", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_NONBLOCK, 0666)
results with
ttyACM0: no such file or directory
The problem is not the path because I tried relative (using chdir) and absolute with same exact outcome.
I even disabled SELinux which is not what I want to do but in search of solution I try anything.
Code is OK because manual execution of the script passes through properly. I think there is something wrong with Linux settings.
The correct path the ttyACM0 is /dev/ttyACM0. You define a udev rules to set the file mode when it attaches.
If that is not reachable from your program, it might be the case that your program runs chrooted().
It seems like it was truly Linux problem and some underlying fabrics of it which I do not understand. I was running Fedora25 but the problem does not occur on Debian8.
I was able to connect to my school server via SSH. I had an assignment in which I was supposed to use the touch command to create a new file. Yet it keeps returning permission denied. Others were able to do the same thing. Though why do I keep getting this error?
Below is what was the input from the terminal.
Last login: Tue Aug 23 09:16:18 on ttys000
Dominiks-Air:~ fsociety95$ ssh djaneka1#navajo.dtcc.edu
djaneka1#navajo.dtcc.edu's password:
Last login: Tue Aug 23 09:16:35 2016 from pool-72-94-210-193.phlapa.fios.verizon.net
Navajo is Linux shell server provided to staff, faculty, and students. The
operating system is RedHat Enterprise Linux 5.
Alpine, a Pine replacement, has been provided as a mail client. Run "pine"
at the command prompt.
This server also provides web space to users. Web pages can be stored in
the ~/www directory. This is also accessible by mapping a drive in Windows
to \navajo\homepage. The URL for your homepage is
http://user.dtcc.edu/~username/.
Your home directory is also accessible in Windows by mapping to
\navajo\.
If something appears broken or missing, please email path#dtcc.edu.
Could not chdir to home directory /u/d/j/djaneka1: No such file or directory
-bash-3.2$ touch today
touch: cannot touch `today': Permission denied
-bash-3.2$ pwd
/
-bash-3.2$ touch today
touch: cannot touch `today': Permission denied
-bash-3.2$
Edit: here is the result of ls -al
-bash-3.2$ ls -al
total 204
drwxr-xr-x 25 root root 4096 Aug 22 16:50 .
drwxr-xr-x 25 root root 4096 Aug 22 16:50 ..
-rw-r--r-- 1 root root 0 Aug 3 14:01 .autofsck
-rw-r--r-- 1 root root 0 Jan 30 2009 .autorelabel
-rw------- 1 root root 2050 Aug 3 14:00 .bash_history
drwxr-xr-x 2 root root 4096 May 4 04:14 bin
drwxr-xr-x 4 root root 3072 Aug 3 13:57 boot
drwxr-xr-x 11 root root 4060 Aug 3 14:02 dev
drwxr-xr-x 87 root root 12288 Aug 23 10:05 etc
drwxr-xr-x 3 root root 4096 Oct 1 2009 home
drwxr-xr-x 13 root root 12288 Jun 1 04:09 lib
drwx------ 2 root root 16384 Mar 24 2008 lost+found
drwxr-xr-x 3 root root 4096 Oct 1 2009 media
drwxr-xr-x 2 root root 0 Aug 3 14:02 misc
drwxr-xr-x 4 root root 4096 May 26 2012 mnt
drwxr-xr-x 2 root root 0 Aug 3 14:02 net
drwxr-xr-x 9 root root 4096 Jan 5 2009 nsr
drwxrwxr-x 3 root root 4096 Oct 12 2015 opt
dr-xr-xr-x 219 root root 0 Aug 3 14:01 proc
drwxr-x--- 12 root root 4096 Apr 22 10:06 root
drwxr-xr-x 2 root root 12288 Aug 4 04:02 sbin
drwxr-xr-x 2 root root 4096 Oct 1 2009 selinux
drwxr-xr-x 2 root root 4096 Oct 1 2009 srv
drwxr-xr-x 11 root root 0 Aug 3 14:01 sys
drwxrwxrwt 38 root root 4096 Aug 23 10:07 tmp
drwxr-xr-x 34 root root 4096 Jun 21 08:29 u
drwxr-xr-x 14 root root 4096 Apr 16 2010 usr
drwxr-xr-x 24 root root 4096 Apr 16 2010 var
-rw------- 1 root root 2865 Dec 16 2008 .viminfo
-bash-3.2$
EDIT:
Here is what I see after trying touch today in /home
So to try and create a new document in the root directory you need to be recognised as root. That means using the sudo command.
However for that you would need a password that you may not have. If you do perfect. But in any case I would not recommend adding files to the root directory.
Instead try the following:
cd home
touch today
This should work just fine and answer your question.
Still if you need/want to create today in your root directory try the following
sudo touch today
You will then be prompted for the root password that you can type (if you have it obviously)
In any case I suggest reading this which may be very helpful for you.
I wonder if this was ever truly answered.
If I was looking at it, I would try to see what the system thinks is the home directory of djaneka1, since it may have been setup partway and not completed, leaving stuff owned by root that should have been owned by djaneka1.
If you use the pwd command, and get back the "/" (root) directory there is something wrong with your setup.
The message: Could not chdir to home directory /u/d/j/djaneka1: No such file or directory
tells you it can't find your home directory.
-bash-3.2$ pwd
/
the command "pwd" revealing "/" is just an artifact of the system not being able to find your home directory.
To find what the system thinks is one's home directory,
one can search the file named '/etc/passwd' for one's login name.
I expect this is a possible result if you do that:
$ fgrep 'djaneka1' /etc/passwd
djaneka1:x:1505:1506::/u/d/j/djaneka1:/bin/bash
since it complained that it couldn't find that directory.
This needs to be fixed by someone who has more rights to the system, like root.
there is nothing djaneka1 can do a
I'd like to think I'm not a linux noob but I am having an issue I can't explain. I hope it something stupid. I have an external drive that I am trying to set up on plex. It was originally formatted ntfs but I shrunk the partition and made another ext4 partition. Plex can't look into the drive and see the folders. I have been trying to change the perms but they aren't sticking. They don't stick if
myUser#mint /media/myUser $ ls -lah
total 44K
drwxr-x---+ 6 root root 4.0K Oct 24 11:21 .
drwxr-xr-x 3 root root 4.0K Oct 24 10:50 ..
drwx------ 1 myUser myUser 20K Oct 14 07:27 DataDisk
myUser#myUserMint /media/myUser $ sudo chmod -R 766 DataDisk/
[sudo] password for myUser:
myUser#mint /media/myUser $ ls -lah
total 44K
drwxr-x---+ 6 root root 4.0K Oct 24 11:21 .
drwxr-xr-x 3 root root 4.0K Oct 24 10:50 ..
drwx------ 1 myUser myUser 20K Oct 14 07:27 DataDisk
myUser#mint /media/myUser $
Am I missing something obvious or is this just weird?
This question already has an answer here:
bash: /bin/myscript: permission denied
(1 answer)
Closed 8 years ago.
when trying to run a teamspeak server and a minecraft server on a newly rented VPS I ran into some big troubles. Whenever I try to run a shell script even when root it does not work.
One script: spigot.sh
#!/bin/sh
BINDIR=$(dirname "$(readlink -fn "$0")")
cd "$BINDIR"
java -Xms5G -Xmx7G -XX:MaxPermSize=128M -jar spigot.jar
Error after trying to use this as root
root#vps23946:/home/user/minecraft# ./spigot.sh
-bash: ./spigot.sh: Permission denied
Error after trying to use this as user
user#vps23946:~/minecraft$ ./spigot.sh
-bash: ./spigot.sh: Permission denied
Results from ls -l
root#vps23946:/home/user/minecraft# ls -l
total 22616
drwxr-xr-x 16 user root 4096 Jun 6 22:39 backups
-rw-r--r-- 1 user root 2 Jun 7 13:54 banned-ips.json
-rw-r--r-- 1 user root 110 May 25 17:32 banned-ips.txt.converted
-rw-r--r-- 1 user root 229 Jun 7 13:54 banned-players.json
-rw-r--r-- 1 user root 267 May 25 17:32 banned-players.txt.converted
-rw-r--r-- 1 user root 1474 Jun 7 13:54 bukkit.yml
-rw-r--r-- 1 user root 610 Jun 7 13:54 commands.yml
drwxr-xr-x 2 user root 4096 Jun 6 19:56 crash-reports
drwxr-xr-x 2 user root 4096 Jun 7 13:54 C:\Users\Rory Finnegan\Desktop\Prep server\backups
drwxr-xr-x 6 user root 4096 Jun 7 14:25 flat
-rw-r--r-- 1 user root 2576 Apr 3 16:04 help.yml
drwxr-xr-x 2 user root 4096 Jun 7 13:54 logs
-rw-r--r-- 1 user root 415 Jun 7 13:54 ops.json
-rw-r--r-- 1 user root 191 May 28 19:02 ops.txt.converted
-rw-r--r-- 1 user root 0 Apr 3 16:05 permissions.yml
drwxr-xr-x 27 user root 4096 Jun 6 22:39 plugins
-rw-r--r-- 1 user root 768 Jun 7 13:54 server.properties
-rw-r--r-- 1 user root 23053543 May 30 15:48 spigot.jar
-rw-r--r-- 1 user root 122 Jun 7 13:36 spigot.sh
-rw-r--r-- 1 user root 2749 Jun 7 13:54 spigot.yml
-rw-r--r-- 1 user root 2404 Jun 7 14:07 usercache.json
-rw-r--r-- 1 user root 1588 Apr 3 16:04 wepif.yml
-rw-r--r-- 1 user root 783 Jun 6 16:21 whitelist.json
-rw-r--r-- 1 user root 250 May 3 19:31 white-list.txt.converted
drwxr-xr-x 7 user root 4096 Jun 7 14:25 world
drwxr-xr-x 6 user root 4096 Jun 7 14:25 world_nether
drwxr-xr-x 6 user root 4096 Jun 7 14:25 world_the_end
Second Script: ts3server_minimal_runscript.sh
#!/bin/sh
export LD_LIBRARY_PATH=".:$LD_LIBRARY_PATH"
D1=$(readlink -f "$0")
D2=$(dirname "${D1}")
cd "${D2}"
if [ -e ts3server_linux_x86 ]; then
if [ -z "`uname | grep Linux`" -o ! -z "`uname -m | grep 64`" ]; then
echo "Do you have the right TS3 Server package for your system? You have: ` uname` `uname -m`, not Linux i386."
fi
./ts3server_linux_x86 $#
elif [ -e ts3server_linux_amd64 ]; then
if [ -z "`uname | grep Linux`" -o -z "`uname -m | grep 64`" ]; then
echo "Do you have the right TS3 Server package for your system? You have: ` uname` `uname -m`, not Linux x86_64."
fi
./ts3server_linux_amd64 $#
elif [ -e ts3server_freebsd_x86 ]; then
if [ ! -z "`uname | grep Linux`" -o ! -z "`uname -m | grep 64`" ]; then
#
With these I get the same errors.
I am running Ubuntu Server 14.04
Scripts and programs must be executable to be invoked by name. Either use chmod to add the executable permission to the file (chmod a+x ./spigot.sh) or invoke an executable interpreter and pass in the script, e.g. /bin/sh ./spigot.sh
Try
chmod +x spigot.sh
and that will enable the script to be executed
I am currently creating an application that requires separate users running duplicate programs. They cannot run under root because of security reasons, so they are initiated by a Java app that I am working on, and I am starting them with runuser -l. However, I cannot cd into a directory, even though it is owned by the user, and the user has 770 permissions in the folder.
Here's what I'm running:
runuser -l lp1 -c 'java \-jar /root/Desktop/workspace/LitePanel/servers/server1/server.jar \-Xms1024M nogui'
And the output of this is:
runuser: warning: cannot change directory to /root/Desktop/workspace/LitePanel/bin/servers/server1/: Permission denied
Here's an ls -all:
drwxr-xr-x. 3 root root 4096 Jan 30 14:03 .
drwxr-xr-x. 7 root root 4096 Jan 30 14:02 ..
drwxrwx---. 2 lp1 lp1 4096 Jan 31 03:07 server1
Inside the directory:
drwxrwx---. 2 lp1 lp1 4096 Jan 31 03:07 .
drwxr-xr-x. 3 root root 4096 Jan 30 14:03 ..
-rwxrwx---. 1 lp1 lp1 9170551 Jan 31 03:07 server.jar
And here's /etc/passwd:
lp1:x:501:501::/root/Desktop/workspace/LitePanel/bin/servers/server1/:/bin/false
Anyone know why this is happening? It looks like the user has the necessary permissions to do this.
You have said that the directory itself has permissions 770 and is owned by the user, but what about its parents? I believe the cd command will need at least read access (and possibly execute) on the parent directories.