Ubuntu Security :: Preventing User From Accessing Command Line
May 8, 2011
I'm trying to set up an unprivileged user on some field systems running 11.04 with the standard Gnome shell (rather than Unity), and ideally that user would not have access to the command line. The user can log in through GDM (but not the text consoles) with no password, so I need to provide the absolute minimum of privileges; basically the user should only be able to run one program.
I've already set the /desktop/gnome/lockdown/disable_command_line key with gconf-editor for that user, which successfully disabled the "Run Command" dialog. Unfortunately, even though the description of the key in gconf-editor says "prevents the user from accessing the terminal...", the terminal emulator is still accessible from the Applications menu, and I haven't been able to find a good way of disabling the terminal or removing it from the menu. The only thing that occurs to me is an ugly hack: replace the gnome-terminal binary with another that checks to make sure the user is not the unprivileged one and then starts gnome-terminal.
I have a 500GB external usb drive connected to my USB router (running dd-wrt). I have the router setup with samba and can read/write to it from any PC on the network. I have it setup to automount in Ubuntu. How can I access that mounted samba share when I SSH into the box? I want to cp or mv files from the PC to the Networked samba share via ssh CLI.
i heard that if pam is denying the user and ftp is allowing the user the user can get the access it means that ftp conf file is stronger than host.deny
I have a problem about user permission, I just destroy my user...So, I create a new one. But I can't have the permission to use "sudo" or to install program... So, I cannot do a lot of thing in my computer. The logical solution is to boot in failsafe mode and access to the root terminal, but, I don't know how to change the permission to allow me to use sudo.
I just installed new Fedora (F15) and I could not figure out how to suspend or hibernate from command line as user. The method I used in previous versions does not seem to work:
Code:
What is new method of command line suspending and hibernating as user?
I am not familiar with Linix server, I have installed ubuntu server for study purpose. Now I am facing problem when I install openssl from command line. This is the error message:
openssh-server : Depends: libwrap0 (>=7.6-4~) but it is not installable E: Broken packages
Why we have to log in as root user some times while we can use sudo in command line ,is it diffrent , does sudo dont have all access and all permessions? i am really lost , i know little of alot of things in ubuntu ,but still missong alot of circles to make the complate picture.
I would like to be able to suspend to disk or Ram from the command line. I can do it with the package 'hibernate' which works well, but it needs to be run as root:
Code:
Do you know if there is any way that I can make this script run by normal users?
I am using a minimal version of 9.04 with openbox.
I adjusted some settings in the desktop settings folder in KDE. I had only one user account on the machine. Next time I rebooted I could not log into KDE (it kept bombing out). I had to log into the console. Finally I managed to create a new account with useradd but this user cannot sudo
My problem is that my home directory is encrypted, so I need a new user with sudo privileges to delete all the kde files and folders in my original users home directory so that I can start with a new KDE setup (which won�t be a bad thing since I tinkered a lot).
How can I add sudo privileges to the new account (I presume I can do it by logging in with my sudo account in a terminal login?
I am learning about group and user management with Fedora and can change the user's group using the usermod command but did not know if there was a command to see the group currently associated with the user.
Just a quick question, is there a system user management app that could be accessed via a website for red hat (or really any distro)? Something kinda like phpMyAdmin, but can do useradd, userdel, groupadd, etc. For remote admins who don't know how to use ssh or the command line.
i have a server running on centos5, i have run vsftp and samba, and i need create a user through command line and set your default directory, i can do this through graphic interface, but i need do throug line command.
The ability to manually boot using the Grub command-line constitutes a big security risk in Linux, IMO.Any OS can be booted in this manner from a PXE-LAN, USB, or CD/DVD drive, circumventing BIOS-imposed boot restrictions. (Once a foreign OS is booted, of course, it can be used to access any part of an unencrypted hard drive.) Placing passwords or locking menu items (in the Grub configuration files) does not prevent a user from booting manually using commands entered at the grub command-line.
As it stands now, when presented with the Grub menu (or after bringing up a hidden Grub menu with the "ESC" key), a user only needs to hit "c" to enter the Grub command-line mode to facilitate any type of bootup whatsoever. (They can then enter manually the Grub commands to boot an OS on any device.) This is extremely insecure and allows any passerby to boot the computer with a few keystrokes and a bootable USB drive. How do I configure Grub so that it will require a password in order to enter the command-line mode (and thereby restrict boot options to the menu, which can then be password protected/locked) ?
I am using Fedora 14. By default Security Enhanced Linux is enabled in Fedora 14. Now is there any way to disable it by command line and then again enable it through command line.
To hide the user input to be displayed on screen, use the terminal line setting command stty -echo, whatever the user enters after this command will not be displayed in the screen. to make the input characters get displayed on the screen use stty echo.
I have read many articles by eminent Linux users who laugh off, when they are asked "is a command line knowledge necessary"?. They go on to say that Linux Distros have evolved so much that the GUI is sufficient! I use my Win.desktop for 1)checking the news, 2)checking my e-mail, 3)writing a blog, 4)Listening to music, and 5)since i am a consultant physician, with specialization in diabetology,keeping up with the trends by visiting a few professional websites! So, my needs are few!Which Distribution would you suggest to a completely Linux-ignorant person,and that's me!
I work with a Debian Squeeze on my laptop and I have a 160GB external hard disk. My hard disk was formatted FAT32, but I decided to format it using ext2. I formatted it using fdisk from command line and everything went well. Unfortunately, when I mount my hard drive(which is auto-mounted from Debian) it has got root both as owner and group. Then I can't write to it because I have no permission to do that. Is there a setting to create an ext2 partition which has as owner the logged system user in order to have right permission every time.
Using the most recent -current/13.37, I'm curious if there is a New Right Way to suspend as a regular user from the command line, now that we've got PolicyKit/ConsoleKit running the show. I've seen some things (e.g., on the Archlinux wiki) that seem to come close, but require UPower. For some reason I can't wrap my head around the PolicyKit documentation well enough to figure this out.
My old solution was to add a line to /etc/sudoers giving anyone in the power group access to pm-suspend, pm-hibernate, and shutdown, and this is probably what I'll end up doing with 13.37.
I need user to input a password through command line in Windows cmd prompt. Is there a way to encrypt the input (such as put it into ......) when user is typing ?
Trying to create a small script that will read user's input, test if user entered some input and if not display some message or display a text using user's input.
The script is the following but i get an error saying "[: 6: =: argument expected"
Currently, a user is able to log into multiple terminals simultaneously, creating a copy of their roaming profile on each, and potentially causing problems if the instances are logged out in the wrong order. Is there any way to prevent this, so that if a user has logged in on a machine and not logged out (and perhaps some timeout has not yet expired) then their login attempts on another machine will be rejected.
is it possible to block an application from using the network? If yes, how? I read it's possible with iptables and with selinux... Also, what about creating a user who can't connect and run the application with that user?
