This is typical situation, you created users that were intended to stay in their /home environment, however they can read around and look all the server directories, here is how to solve this situation
How do I restrict user's to their home dir in the telnet/shell?Problem:Is it possible to restrict users to their home directory in telnet and/or ssh ? Solution:
Traditionally, the best way to "lock down" users to their home directory is to use a "change rooted environment". However, this is expensive (resource wise) and sometimes not a very "nice" way to secure a server on a user per user basis. For V-hosters, most of your concern lies in the simple feat of keeping customers from poking around your system, and other user's home dirs--without limiting their ability to execute binaries in their normal system path.
Solution:
For restricting your shell user's directory access to /home/username (while allowing executing from the system path) you (the admin) can use bash2 or "rbash" instead of just bash. When a user uses bash2 via the sym-link "rbash", bash2 will note this and run in "restricted mode". Basically, it simply does not allow them to invoke anything above their own home directory from the command line... but all other spawned apps have normal system access. Type "info bash2" for more info on the restrictions. bash2 comes standard in our RedHat 6.2 and higher systems. To set up your system to use it... just do this:
|
||||||||||