How can I make access to command line more secure? Is there any way to make it secure when using the system as a guest user? Once a user session is open then anyone can open terminal without any credentials. What want exactly is for a password to be requested before opening terminal.
This is addressing the content of your question.
How can I make access to command line more secure
It's hardly possible to restrict access to a commandline. While you might restrict access to the installed
gnome-terminal there are other default installed terminals that can be access. These include
lxterm, and x-terminal-emulator. If you disabled or uninstall all defaulted installed terminals, a user could easily download a terminal to his personal space and run a commandline from there.
Commanlines don't need a terminal to be executed
Many of the commands I perform, I perform in a script... often a oneline script.
While the ways to browse the system and execute commands are to vase to contain in one message, I'll give an example of one easy method.
1. From the Ubuntu Dash search type gedit 2. In the window type: #!/bin/bash bash 3. Save the file as mytermial. 4. From the file browser right/cick the file -> (click) Properties -> (checkmark) Allow executing file as program -> Close 5. Now double click the file and you are in a terminal.
Instead of the command being
bash it could be
ls to browse anywhere on the system, as well as
cat to list anything on the system, that the user has permission to access. That makes the only real solution to be check permissions of sensitive data.
Modifying your system files may break your system, making it hard for users (including your account) with access to perform their task.
For security purposes you should protect the data by placing restrictive access to the specific data, data files, and data directories. For instance, the
mysql directory has sensitive data. It's located in the
/var/lib/mysql area. The file mask permissions is
700. This means that only the database engine
Mysql or some special
root controller can access the directory or files there within. This is the permission scheme used for real security in Linux which is tested and works. Methods outside of this could create a harmful false sense of security.
There are alternatives that you could setup specifically for restricting users access on your system. For instance you could setup jails for the users you don't want to have access to browse the regular directory structure. This is done for the default guest account. The jailed user account will not be able to see outside of the provided directory stucture.
Look at: Jailkit. It's a set of utilities to limit user access to specific areas using Linux's
chroot and or specific commands.
Some detail discussion on this can be found at:
Simple & easy way to jail users
I don't think the jailed alternative solution would be as good as
make the access to the command line more secure being sure to
secure the files and directories of the sensitive data
Example files showing permissions bits:
drwxr-xr-x 104 root root 4096 Oct 25 10:33 /etc -rw-r----- 1 root shadow 1119 Oct 25 09:50 /etc/shadow
The permissions are grouped in threes. Starting with the second bit, the first group (of threes) is the owner of the item
u. The second group is the group
g, and the last group is others
o. As long as you don't have any of the bits set on the last group of three bits, a regular user will not be able to access that area or file. Those bits are
execute. So remove the last bit from your sensitive data directory and others will not have access to it. This can be done with:
$ chmod o-x [directoryname]
Alternatively you could have is set where the user may be able to enter the directory but not actually browse (or see directly) the directory with:
$ chmod o-r [directoryname]
You can use that scheme to easily check and verify who has access to what.
The final answer is that you can't provide security by making changes to your various terminal emulators and the actual command line, because there are so many alternatives to access the data without using the commandline directly, such as a filebrowser. The real solution for security is through permissions control