On 02/26/2011 12:09 AM, Dan Sheffner wrote:
Like Michael said I would accomplish this with two users. Just off the
top of my head I would do:
user 1) has full read/write access to /home/user1
user 2) has read only access to /home/user2
schedule cron to rsync from /home/user1 to /home/user2 and make
everything read only for the /home/user2.
Dan
Not knowing what exactly you are trying to achieve, it's hard to give
you a specific answer.
Like others have suggested, you seem to try to complicate too much. To
add to Dan's suggestion; you can have login setup for unlimited number
of users to share the same home directory. Depending on the group
permissions you can restrict access rights to different users.
However, to limit abilities of each user to "do things on the same
files" you would need to use a different shell.
For example:
-- User-- -- Group--
user1 group1
user2 group2
user3 group2
user4 group3
user1:x:1000:1000:User One,,,:/home/user1:/bin/bash
user2:x:1001:1005:User One,,,:/home/user1:/bin/bash
user3:x:1002:1005:User One,,,:/home/user1:/bin/rsh
user4:x:1003:1005:User One,,,:/home/user4:/usr/local/bin/script
^ ^
| |
UID ------| |
GID -----------|
Permissions for user1 home directory (or any other directory!)
drwxr-x--- group1 /home/user1
has read, write, and execute access to everything
user2 is in group2 (GID) so it has read and execute access in /home/user1
user3 has also read and execute access in /home/user1 but has a
restricted shell. Note that rsh is a name for different shells to make
it more confusing.
user4 would only be able to run a certain script that would "do things
on user1's files". /usr/local/bin/script could be any program including
GUI. Not the most elegant but certainly possible.
Assuming you are doing this on LAN, you could simply use NFS to restrict
users to read only from systems with particular IPs.
Note that "home directory" is nothing special. It's just a place where
user is put in during login by what is specified in the /etc/passwd
file. That's why two user system suggested by Dan is the easiest to do.
The above are not the only options and you don't need to restrict
yourself to ssh protocol. If you want a user from a specific address to
only see files on another system you could run web server in either http
or https mode and setup appropriate authentication to connect.
To get to your original request, you could use ssh_config and it's
option LocalCommand. I haven't tried it, but if I understand this
correctly, you could execute command, a restricted shell for example,
as soon as you login. Check man pages.
Note that user1 on 192.168.1.2 could be put in different group than
user1 on 192.168.1.1. If you used sshfs and remapped user/group ID, you
could make it read only.
sshfs is the best way to mount whatever directory from a remote system
to a local one as it provides "instant effect" in file changes unlike
rsync sftp etc.
In general, it's better to have "data files" elsewhere than home
directory as that makes it easier to put restrictions on their
permissions including chroot. Why give somebody read only access to your
home if you don't trust them in the first place? That's pry bar in the door.
I believe that a setup with two different logins and "dedicated data
area" outside user home directory is the safest and the easiest to do.
Not only that, it prevents your big security hole. Just because you
restrict _user1_ from 192.168.1.2 to a read only mode, nothing (?)
prevents that same user to go from 192.168.1.2 to 192.168.1.15 and hop
to 192.168.1.1.
Two users sharing an account on any system connected to the Internet is
like sharing used shorts.
On Sat, Feb 26, 2011 at 2:04 AM, Michael Zoet <michael.z...@zoet.de
<mailto:michael.z...@zoet.de>> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Am 26.02.2011 06 <tel:26.02.2011%2006>:32, schrieb Tapas Mishra:
> Hi,
Hi Tapas,
>
> I would like to allow a user to login through SSH but with different
> permission coming from different ipaddress.
>
> For example, a user "tester" login to SSH through 192.168.1.1 and
> another user login with the same login id "tester" but from different
> ip 192.168.1.2.
>
> How do I restrict 192.168.1.2 to only allow for viewing the
content in
> the home directory while giving 192.168.1.1 full access?
Why do you have to use the same user? Viewing the contents of a
directory has nothing to do with SSH and you need to use some other
methods. So using different users to login would be the easiest to
accomplish this. Then you need only to change the permissions on the
filesystem. And if you are using POSIX ACLs you have more options than
you will ever need for this situation. Keep it simple is the best way
for system administration.
>
>
> I got a suggestion from some one
>
> Approach 1)
> Based on the ip you change the shell. If it's just for read only a
> jail would be fine.
>
> but how do I change shell based on IP?
>
> Approach 2)
>
> to have two ssh instances. Let's say port 22 and port 24. Port 22 is
> for read only, while port 24 is for full access
>
> so how can it be possible to give port 22 only read only access
to SSH
>
>
Maybe you can tweak PAM and do some shell scripting to achieve both
aproaches. But why? If you do it not right you might break your
system. I really do not know what this could be good for... Using 2
users is the easiest way.
Bye,
Michael
--
ubuntu-server mailing list
ubuntu-server@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server
More info: https://wiki.ubuntu.com/ServerTeam
