Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

(Prenote:
      Sorry if this is the wrong forum... I assume this is the one for sysadmins and power/super
      users)

It was just a query that came when I was strutting around, doing the old "rm -rf /" (Har har):

How does an admin, on a unix based system that runs the linux kernel stop people from going into the files like /sys ? Leading on from that:

How does the sysadmin stop people from using commands like: "rm -rf /"

Again, I'm sorry if this is the wrong forum.

share|improve this question
4  
The british empire had quite a success with hanging people in front of crowds, to scare of said crowd. –  JustSid Jan 5 '12 at 14:36
    
@JustSid: In America, a baseball bat seems more culturally appropriate. –  surfasb Jan 17 '12 at 22:13

4 Answers 4

up vote 6 down vote accepted

A basic user on a linux system doesn't have the permissions needed to cause any damage to the system itself. If you try to do "rm -rf /" to any linux system as a regular user, you're going to get a lot of "permission denied" errors, though you will wipe out anything that belongs to you (i.e., your home directory).

What's dangerous is giving people sudo access, or if the root password is known. In that case there is nothing to prevent a person with that access from doing damange via "rm -rf /".

share|improve this answer
    
No big deal then... Only the sudo files and the password need to be kept under extreme security. Thank you! –  Bajinga Jan 5 '12 at 14:41

By allocating permissions on files and directories (folders) using commands like chmod, chown and chgrp.

Ordinary users can't delete files in directories for which they don't have write permission.

share|improve this answer
    
Ah, I see. So the commands are kept in files. Thank you! –  Bajinga Jan 5 '12 at 14:40
    
@Bajinga: Yes, commands happen to be kept in files, but that's not what RedGrittyBrick is talking about. The commands chmod, chown, and chgrp are used to set ownership and permissions on files and directories. Non-root users are not able to do certain things to those files and directories. –  Keith Thompson Jan 17 '12 at 21:37

RedGrittyBrick and churnd are correct. I'd like to add a few things:

  • It's important to use permissions and ownerships to ensure that users can only hurt themselves. By default Linux is configured this way.

  • Users need read access to places like /etc and /usr because their programs load libraries and find configuration information in those directories. If you try to lock them out, things will break badly.

  • A good administrator keeps regular backups of user /home directories, so that if a user wipes their own home directory, they'll only lose a day of work.

  • Reserve sudo access carefully. Even commands which you think are safe, should be reserved for people you trust.

  • root access is the key to the kingdom.

  • Don't try to find false security in restricted shells, they're really just designed to protect the users from themselves. They can be circumvented and users can still find ways to run nasty commands. http://en.wikipedia.org/wiki/Restricted_shell

share|improve this answer
    
Thank you! Great answer here. I'll read into the shell's and only thank you for it. +1! –  Bajinga Jan 5 '12 at 15:22

In some cases admin don't want to give shell to users. this can be done with command:

chsh username 

and when system prompts you to answer which shell to give to user - just type: false

share|improve this answer
    
false, of course, is a program that immediately quits with exit code 1. When the user tries to log in with this shell configured, it will simply quit immediately. –  Daniel Beck Jan 17 '12 at 20:36
    
that pretty much denies the user access to the system. You might as well just delete the account. –  Keith Thompson Jan 17 '12 at 21:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.