Create UNIX user with restrictions (66 Views)
Reply
Advisor
Khurram Khan_1
Posts: 25
Registered: ‎11-07-2000
Message 1 of 27 (66 Views)

Create UNIX user with restrictions

HI,

Would like to know how to create a UNIX user, who I only want to use omniback and shouldn't be bale to remove, delete, copy or anything else apart from logon to the system.

Regards

Khurram
Please use plain text.
Occasional Visitor
Michael Albrecht
Posts: 4
Registered: ‎12-13-1999
Message 2 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi ,

create a user with restricted shell
/bin/rsh

make a link in users home dir to Omniback start script xomni

Hope it helps
Michael
In pepperland all things are possible
Please use plain text.
Advisor
Khurram Khan_1
Posts: 25
Registered: ‎11-07-2000
Message 3 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi,

Do you mind listing the commands step by step, thanks.


Regards

Khurram
Please use plain text.
Trusted Contributor
Sukant Naik
Posts: 192
Registered: ‎06-10-1999
Message 4 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi Khurram,

Do you want the user to just run the xomni

............
/opt/omni/bin/xomni
exit

This will just invoke the xomni whenever he logins. The moment he closes the xomni, the exit will be executed and he will be logged out of the session.

Can anybody in the forum tell me, what are the threats which I will face with this...I mean can a user go to the shell prompt in any way.

- Sukant

Regards,

Sukant
Who dares he wins
Please use plain text.
Trusted Contributor
Sukant Naik
Posts: 192
Registered: ‎06-10-1999
Message 5 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi Khurram,

Do you want the user to just run the xomni

............
/opt/omni/bin/xomni
exit

This will just invoke the xomni whenever he logins. The moment he closes the xomni, the exit will be executed and he will be logged out of the session.

Can anybody in the forum tell me, what are the threats which I will face with this...I mean can a user go to the shell prompt in any way.

- Sukant

Who dares he wins
Please use plain text.
Trusted Contributor
Sukant Naik
Posts: 192
Registered: ‎06-10-1999
Message 6 of 27 (66 Views)

Re: Create UNIX user with restrictions

Sorry for the incomplete answer which I sent earlier.

You need to add the entry in the .profile of that user.

- Sukant
Who dares he wins
Please use plain text.
Advisor
Khurram Khan_1
Posts: 25
Registered: ‎11-07-2000
Message 7 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi,

The users will log into Omniback using Reflections, which means they log into unix first and then type xomni&. So need to make sure when they log into UNIX, they should have very restricted permissions to do anything at all apart from type in the command xomni and not be able to move, copy or delete anything.

Regards

Khurram
Please use plain text.
Respected Contributor
hpuxrox
Posts: 495
Registered: ‎04-01-2002
Message 8 of 27 (66 Views)

Re: Create UNIX user with restrictions


ps -ef | grep X | grep -v grep | awk '{print $2}' | xargs kill -HUP

Please use plain text.
Respected Contributor
hpuxrox
Posts: 495
Registered: ‎04-01-2002
Message 9 of 27 (66 Views)

Re: Create UNIX user with restrictions

Please disreguard my last post. I does't apply to this forum thread.

Thanks,
Please use plain text.
Respected Contributor
Tony Contratto
Posts: 69
Registered: ‎04-04-2002
Message 10 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi Khurram,

I'm not sure about Reflection but with Exceed you can create a session that only starts a single specific X application. You may want to look into whether or not Reflection has this type of capability.

Tony
got root?
Please use plain text.
Honored Contributor
Frank Slootweg
Posts: 890
Registered: ‎09-06-2001
Message 11 of 27 (66 Views)

Re: Create UNIX user with restrictions

> The users will log into Omniback using Reflections, which means they log into unix first and then type xomni&.

*Where* do they type "xomni&"? In a (hpterm/xterm) window? If so, how do they *get* that window? If automatically (i.e. by X/CDE/VUE), then just put the "xomni" (no "&") in the startup (.profile) of that user/window and an "exit" after it. That will give them a 'busy' window with which they can do nothing, and the desired OmniBack GUI. This setup is not hacker-proof, but should be sufficient for a person which can be trusted, but might *accidentily* get hirself in trouble.
Please use plain text.
Trusted Contributor
Sukant Naik
Posts: 192
Registered: ‎06-10-1999
Message 12 of 27 (66 Views)

Re: Create UNIX user with restrictions


This solution of updating the .profile has been given by me to many non-IT companies here for making them work only on their application and the moment the user is through with his application he is just logged out when he closed his application.

-Sukant
Who dares he wins
Please use plain text.
Honored Contributor
MANOJ SRIVASTAVA
Posts: 1,885
Registered: ‎07-10-2000
Message 13 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi Khurram


Create a user normally , and edit /etc/passwd file and in the last field replace the shell by rsh .In the home direcoty of the user , edit the .profile with whatever command you want to give for running omni back.


Manoj Srivastava
Please use plain text.
Advisor
Khurram Khan_1
Posts: 25
Registered: ‎11-07-2000
Message 14 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi,

Adding the rsh in the password file definately works, not too sure what I need to add in the .profile. The command to access omniback is xomni or xomni&, and the path is /opt/omni/bin. So please advise as to what command to enter in the .profile, thanks.

Regards

Khurram
Please use plain text.
Honored Contributor
MANOJ SRIVASTAVA
Posts: 1,885
Registered: ‎07-10-2000
Message 15 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi Khurram


in the .profile

add export DISPLAY=
/opt/omni/bin/xomni


also please note that you might have to give omnibak group to this user , or change the group to 3 which that of the super user.

Manoj Srivastava
Please use plain text.
Advisor
Khurram Khan_1
Posts: 25
Registered: ‎11-07-2000
Message 16 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi,

When I add the following:

export DISPLAY=194.60.97.70 (the IP for the DB server / UNIX server)
/opt/omni/bin/xomni

Now I get the error message:

Error: Can't open display: 194.60.97.70

The entry in the password file is as follows:
enduser:OVw7qGPBcfpBI:103:111:,,,:/home/enduser:/usr/bin/sh (if I change the sh to rsh, then I don't get anything at all)

The users are using Reflections to open a X terminal window, I would like to restrict them so that they can't change anything at UNIX.


Regards


Khurram
Please use plain text.
Super Advisor
Gary Yu
Posts: 253
Registered: ‎08-07-2001
Message 17 of 27 (66 Views)

Re: Create UNIX user with restrictions

another thing should do if you are using the .profile method is -- trap all interrupt signals at the first line of your .profile, otherwise, a user can quickly issue a 'Ctrl-C' when login (before login gets to your command in the .profile, often at the bottom) and break into command line mode.

You can test this by putting a 'sleep 30' in your profile before the line of user's script, and try to break it when login.

cheers,
Gary

Please use plain text.
Advisor
Jacob_2
Posts: 19
Registered: ‎11-17-1999
Message 18 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi,

Assuming that the omni_user logs in from reflection.

create this user with a restricted shell and in his .profile, export his Display ( you may need to read the ipaddress of the PC from whereever this user logs in).
Also allow xomni& to be executed from the .profile.
To avoid the user from branching out to the shell , restrict him with TRAP.

In addition to this all omni executables ( /opt/omni/lbin,/opt/omni/bin) & configuration files ( /etc/opt/omni/*) may need to be given permissions for this user.
Just in case he needs to change the datalist or the schedules.

An alternative will be using SCM ( service control manager.
Please use plain text.
Honored Contributor
MANOJ SRIVASTAVA
Posts: 1,885
Registered: ‎07-10-2000
Message 19 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi Khurram

I think I didnot make it clear , the IP that had to be exported is where the user is running the xomni and not that of the server .
Like i am using the desktop which has the reflection s/w loaded , i go to the dos prompt by typing command in the run mode in window , then i run a command ipconfig and get the IP address of the desktop . Also please modify the export DISPLAY as

export DISPLAY=aa.bb.cc.dd:0.0

Manoj Srivastava
Please use plain text.
Advisor
Khurram Khan_1
Posts: 25
Registered: ‎11-07-2000
Message 20 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi,

May be I am not making it very clear, I will start from the very beginning:

The end users have different computers, so there IP addressses will not be statitc and are using windows NT. They log into UNIX using Refelections (X term), which after entering there name e.g. enduser, are asked to enter there password. Once that is complete they log into UNIX, and then they type in Xomni or Xomni& to access Omniback. I have already restricted access to Omniback, but not too sure how I can restrict the access to UNIX, as I don't want users to delete, move, copy or do anything at UNIX apart from type in Xomni or go to Omniback dirrectly. Whatever the advise, please list in detail the commands to be used, thanks.


Regards


Khurram
Please use plain text.
Honored Contributor
MANOJ SRIVASTAVA
Posts: 1,885
Registered: ‎07-10-2000
Message 21 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi Khurram

It looks like that you are taking care to do export DISPLAY while the users login itself and they are able to run xomni w/o doing an export DISPLAY , in that case in the end of .profile just add /opt/omni/bin/xomni and that should work , this is provided you are setting the display variable during the login process it self.


Manoj Srivastava
Please use plain text.
Advisor
Khurram Khan_1
Posts: 25
Registered: ‎11-07-2000
Message 22 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi Manoj,

That works fine, until when they end there omniback session and do a exit. Then they are back to the xterm window with unix on it, and this is where the problem lies i.e. they can cd into any directory and do anything they want. That's what I need to control and restrict, not too sure how.

Regards

Khurram
Please use plain text.
Honored Contributor
Shannon Petry
Posts: 1,343
Registered: ‎12-17-1998
Message 23 of 27 (66 Views)

Re: Create UNIX user with restrictions

Considering your needs and concerns, here is my 2 cents worth.

1. Create normal user accounts (NOT ROOT) and give them to the users. set their default umask to 0177 so they can not touch each others stuff.
This is done in their $HOME/.profile and $HOME/.login.
2. Configure the ID in omniback to give them access to their needs. I.E. backup, restore, list, monitor, etc...
3. Configure reflections to launch the command for them. I.E. instead of launching an Xterm, have them launch this.
xterm -e /opt/omni/bin/xomni
or
/opt/omni/bin/xomni


If your server/workstation is accessed so what? They really can not hurt anything unless someone opened up access on all the files. It's not important if they can see /etc/passwd, but is important if they can edit it! Good admin practices should nullify the users abilities to play with the system.

Regards,
Shannon
Microsoft. When do you want a virus today?
Please use plain text.
Honored Contributor
MANOJ SRIVASTAVA
Posts: 1,885
Registered: ‎07-10-2000
Message 24 of 27 (66 Views)

Re: Create UNIX user with restrictions

But if you are in rsh it should not let you go to any other directories and also put an exit after the xomni command so that after xomni it exits .


Manoj Srivastava
Please use plain text.
Advisor
Khurram Khan_1
Posts: 25
Registered: ‎11-07-2000
Message 25 of 27 (66 Views)

Re: Create UNIX user with restrictions

Hi,

After putting in the rsh in the password file, it doesn't even bring up the Omnback terminal. When I take rsh out of the /etc/passwd file, it works fine untill the user clicks on exit in the Omniback Ixcon then it goes to the Xtreminal session at Unix. This is where the problem is, the easiest way would be to configure it as such that the user goes dirrectly into Omniback through Reflections. But unfortunately I don't know how to configure such a process in Reflections. Appreciate everyone's advise so far, but I really could do with some more help (detail commands etc), thanks.

Regards

Khurram
Please use plain text.
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation