Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am new to Linux and need some help how I can create a user with some special rights.

I have read a few articles and "how Linux permissions work" but have not yet understood how it works in practice.

I want to create a user that does not get any rights to use "su / sudo" or have any read / write access to the rest of the system in addition to its own home directory. Besides this, then that users have rights to read, write and modify another specified user's home directory.

Is this possible? An explanation and the necessary commands appreciated tremendously :)

  • The "read/write to the rest of the system"-part is not mandatory. The important part is the read/write/modify access to another user's homefolder.
share|improve this question
    
Please specify in more detail what you are trying to achieve. Some of what you describe is fairly easy but some of it is unclear. By default (on most distributions) users do not have right to execute sudo. But the rest of that paragraph is not very clear. Again by default users can read/write only their own home directories. If you need users to share files etc. it's probably most convenient to create a "global" directory owned by a dedicated group and assign the users to that group. You can achieve the same with several options, which one is best depends on what you want to achieve. –  Bram May 28 '12 at 11:21
    
Alright. Forget about the sudo part since I configured a "allowed sudoers" instead. I already have som services up and running which works in a existing homefolder. It would be best practice to create another global folder instead, however, it will take alot of time to reconfigure my running services. I added all the users who shall have permissions to the folder in a group. Scenario; anders owns the folder /home/anders/. The group "research" should also have full access to /home/anders. Anders should still have same permissions as always. Regards –  Simon May 28 '12 at 11:49
    
I kinda know how to do it, (through some googling regarding permissions) but Im not sure, and really don't want to mess up the existing persmissions for the user "anders" since some services is already up and running. –  Simon May 28 '12 at 11:57
    
Files used by a group shouldn't be in any of the group members' home directory. A user's home dir is "private" because it contains things no other user should be able to access. As an example a lot of configuration files might contain passwords and other private data. Granting other users access is inviting a world of pain and other security risks. It is a lot easier and more importantly safer to create a directory for research and grant anders and the other members of the "research" team (group) access to that directory. As for services they are best to run from /opt, /var or /usr/local. –  Bram May 28 '12 at 13:11
    
Is the "specified user" used only for the purpose of holding this shared directory? If so, just give all the users who should have access to the specified user the right to sudo to that specified user. That will give them all that user's rights, including the rights to their home directory. (Which should be all they have.) –  David Schwartz May 28 '12 at 13:13
show 3 more comments

2 Answers

You can grant permission to the user you need using setfacl (set file access control list)

e.g.:

setfacl -R -m u:snooper:rw target-user
share|improve this answer
add comment
  1. Create a dedicated user and group "resaerch" to run the services with a home dir outside the regular /home e.g. /research
  2. Add all users that need access to the research dir to the "research" group and set their home dir to /research and disallow their logon by setting the login shell to /sbin/nologin
  3. Set up the FTP daemon to chroot users to their home dir so they can only see this dir
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.