setting proper permissions

Question

I just read up on setting up user privileges for different kinds of users. Id like to create a scenario where a user can ssh into the system but can create(write) files only in /tmp. Write access should not be allowed anywhere else. Also, he should not be able to view another users files within /tmp, let alone delete them.

I believe I can accomplish the second half of the task by removing read and execute permission of /tmp and setting the sticky bit.

However how would i go about removing the users write access from the rest of the system?

Answer 1

Id like to create a scenario where a user can ssh into the system but can create(write) files only in /tmp. Write access should not be allowed anywhere else.

In a standard Linux installation, users can write only to /tmp and their home directories. So you can achieve this by making a user's $HOME read-only and owned by root.

Also, he should not be able to view another users files within /tmp, let alone delete them.

Give all users a restrictive umask (such as 077) through pam_umask, and set the sticky bit on /tmp.

Also, play with pam_namespace - you can give each user his own /tmp.

I believe I can accomplish the second half of the task by removing read and execute permission of /tmp and setting the sticky bit.

Incorrect. Without execute permissions on /tmp, the user won't be able to access or create anything in that directory. Without the sticky bit, anyone who can write to /tmp will be allowed to remove anyone's files.

However how would i go about removing the users write access from the rest of the system?

They don't have write access by default. See top of this answer.