NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/comp/unix/shell/5274

Text File | 1993-01-06 | 1.8 KB | 35 lines

Newsgroups: comp.unix.shell
Path: sparky!uunet!think.com!ames!haven.umd.edu!news.umbc.edu!gmuvax2!wvarga
From: [e-mail] (Wilson Varga)
Subject: Re: How to make Restrict Shell more safely?
Message-ID: <[e-mail]>
Summary: try a commercial product for the purpose
Organization: George Mason University, Fairfax, Va.
References: <[e-mail]> <[e-mail]> <[e-mail]>
Date: Wed, 6 Jan 1993 13:56:39 GMT
Lines: 23

In article <[e-mail]> [e-mail] (John Navarra) writes:
>In article <[e-mail]> [e-mail] (bill davidsen) writes:
>>  4. Remember that some programs give shell access via escapes, like vi,
>>emacs, etc. Some versions use PATH and are safe, some use /bin/sh and
>>are not at all safe.
>
>Yeah, here is the BIG problem. If you want to let restricted users have
>access to vi, mail, and news, you have the shell escape problem. This
>is not a trivial thing to fix -- especially if you don't have the source.
>
>>  5. The *really* safe way to have guest users is to run them in a tiny
>>system of their own using chroot. It is very hard to do this without
>>losing a lot of functionality, however, so I don't do that.

There is a commercial product, CENTRUS UX, that solves all of this by
keeping end-users within a menu system.  What the resrticted class of
end-users is permitted to do/not do is entirely under the control of
the system administrator.  Access to any of the unix shells is also
effectively eliminated, without restricting the functionality of
applications such as vi.  Contact the company directly for more
information.  I know that CENTRUS is currently available for HP-UX, but
the company is seeking to compile for other versions of unix.
Contact [e-mail].