0

I am new to Linux and need some help how I can create a user with some special rights.

I have read a few articles and "how Linux permissions work" but have not yet understood how it works in practice.

I want to create a user that does not get any rights to use "su / sudo" or have any read / write access to the rest of the system in addition to its own home directory. Besides this, then that users have rights to read, write and modify another specified user's home directory.

Is this possible? An explanation and the necessary commands appreciated tremendously :)

  • The "read/write to the rest of the system"-part is not mandatory. The important part is the read/write/modify access to another user's homefolder.
Improve this question
8
  • Please specify in more detail what you are trying to achieve. Some of what you describe is fairly easy but some of it is unclear. By default (on most distributions) users do not have right to execute sudo. But the rest of that paragraph is not very clear. Again by default users can read/write only their own home directories. If you need users to share files etc. it's probably most convenient to create a "global" directory owned by a dedicated group and assign the users to that group. You can achieve the same with several options, which one is best depends on what you want to achieve.
    – Bram
    May 28, 2012 at 11:21
  • Alright. Forget about the sudo part since I configured a "allowed sudoers" instead. I already have som services up and running which works in a existing homefolder. It would be best practice to create another global folder instead, however, it will take alot of time to reconfigure my running services. I added all the users who shall have permissions to the folder in a group. Scenario; anders owns the folder /home/anders/. The group "research" should also have full access to /home/anders. Anders should still have same permissions as always. Regards
    – Simon
    May 28, 2012 at 11:49
  • I kinda know how to do it, (through some googling regarding permissions) but Im not sure, and really don't want to mess up the existing persmissions for the user "anders" since some services is already up and running.
    – Simon
    May 28, 2012 at 11:57
  • Files used by a group shouldn't be in any of the group members' home directory. A user's home dir is "private" because it contains things no other user should be able to access. As an example a lot of configuration files might contain passwords and other private data. Granting other users access is inviting a world of pain and other security risks. It is a lot easier and more importantly safer to create a directory for research and grant anders and the other members of the "research" team (group) access to that directory. As for services they are best to run from /opt, /var or /usr/local.
    – Bram
    May 28, 2012 at 13:11
  • Is the "specified user" used only for the purpose of holding this shared directory? If so, just give all the users who should have access to the specified user the right to sudo to that specified user. That will give them all that user's rights, including the rights to their home directory. (Which should be all they have.)
    – David Schwartz
    May 28, 2012 at 13:13

2 Answers 2

Reset to default
1

You can grant permission to the user you need using setfacl (set file access control list)

e.g.:

setfacl -R -m u:snooper:rw target-user
Improve this answer
0
0
  1. Create a dedicated user and group "resaerch" to run the services with a home dir outside the regular /home e.g. /research
  2. Add all users that need access to the research dir to the "research" group and set their home dir to /research and disallow their logon by setting the login shell to /sbin/nologin
  3. Set up the FTP daemon to chroot users to their home dir so they can only see this dir
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .