0

As the title suggests, I have a multi user environment, and in the interest of protecting privacy, I'd really like to be able to restrict users access to some of these publicly viewable files that give away info about other users.

If I restrict access to /etc/passwd with 0640, things stop working for that user.

If I add that user to a restrictive ACL, things stop working for that user.

I'd really like to avoid kicking unprivileged-users in to a jail if I can. I just want user privacy to be respected on a shared server. Any ideas?

Improve this question
  • I don't quite understand what privacy you wish to protect. "Hubert is in the Fancy group" doesn't seem personal or useful. Can you please clarify a bit? – user535733 Jun 2 '18 at 3:29
  • 3
    as mentioned in serverfault.com/questions/154345/… these files have to be readable. – Wiglaf Pimwick Jun 2 '18 at 5:11
  • 1
    @user535733 - For example, my intention was to use a clients domain name on a web server, as their username. So, jesus-is-our-saviour--com, or milfs-like-to-have-fun--net, etc... If clients can just less /etc/passwd and see that other clients we're dealing with don't fit with their morals, then it could cost clients, alternatively, competitors could get an account to simply see our client list... I guess I'll have to look at another naming scheme for clients? Unless there's any other ideas? – Jack_Hu Jun 2 '18 at 12:35
  • Use docker and give each client a separate vm – Panther Jun 4 '18 at 0:56
  • 1
    At this point I figure just having undescriptive usernames is the way to go. I realise I could have special ssh login shells, using LXC, but that's a lot more trouble than it's worth IMO. Saying that, what other methods are there of obtaining usernames? I realise that site names can be obtained from the vhosts, but they're already locked down to the apache user/group (which users aren't a part of)..? – Jack_Hu Jun 5 '18 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.