Re: [gentoo-user] Reconciling users and services

[Alan McKinnon <alan.mckinnon@gmail.com>]

On Sunday 18 January 2009 00:09:31 Grant wrote:
> I have some users on a system and some services.  How can I make sure
> only certain users can log into certain services?  Do I need to
> explicitly define which users can log into each service?  Are there
> different types of users so that some can only log into certain
> services?
>
> For example, I know any user that has their shell set to /bin/nologin
> can't log into a shell.  How can I check on users' shell settings?
>
> - Grant

To do this you configure each service separately (there is no central 
registry-type thing for this). You don't say what "services" you are 
interested in, so I have to make some assumptions.

apache, samba, ftp servers, all have their own authentication methods. You 
have to research what methods they provide, and choose which is most 
appropriate. For instance, Samba can auth against kerberos/ldap or using a 
local smbpasswd file. For a specific user to be able to access something via 
samba, you ensure they have an entry in AD or a line in smbpasswd.

For more simple local services, you can use user and group permissions. I have 
to restrict cron and wget at work, I find the easiest way is to:
chown root:trusted /usr/bin/wget
chown root:trusted /usr/bin/crontab
users authorized to use wget/cron must then be put in the trusted group.

cron has it's cron.allow and cron.deny files that you can also use.

sshd has config options to limit who can do what in sshd_config.

If you post back with more specifics about what you want to achieve, we can 
assist you better.


-- 
alan dot mckinnon at gmail dot com