50

The specific attack you've expressed concern about is: often an attacker will just fool a gullible user into running an executable by downloading and clicking. At least in the common case where the file is downloaded in a web browser, this should already be prevented in Ubuntu by the browser's adherence to the Execute-Permission Bit Required policy. The ...


49

I have solved the issue by creating a new group for limited admin rights... name of that group is LimitedAdmins after that I updated the sudoers file as below. The line I appended is: %LimitedAdmins ALL=NOPASSWD: /usr/bin/apt-get*, /etc/init.d/apache2 restart This is the complete /etc/sudoers file: # This file MUST be edited with the 'visudo' command ...


13

Permission to view log files is granted to users being in the group adm. Ubuntu: Privileges To add a user to this group on the command line issue: sudo usermod -aG adm <USER>


12

Looks like comma is what you need. Cmnd_Alias PRINTING = /usr/sbin/lpc, /usr/bin/lprm ... user3 ALL= PRINTING Source


11

YES* It's called a restricted shell. You can use /bin/rbash, which is already available in Ubuntu and combine that with a restricted PATH variable. The rbash will prohibit execution from anything that is not in $PATH. Add a restricted user: sudo adduser --shell /bin/rbash res-user Make a new directory, where we can link binaries in, that the user will ...


5

If you are looking to ban users that you allow to log in from using a terminal for security reasons, it does not make much sense. "The Terminal" is a tool that will allow you to perform certain actions that you have rights to do. If you take away the right to run "the terminal" (which is actually just another program), the right to perform these actions is ...


5

Remove them from the cdrom group (as well as admin/adm/sudo) to restrict the privileges: deluser username groupname e.g. deluser gert cdrom Then log out and log back in to make it effective. Note! Make sure to use the second argument to deluser, otherwise it will delete the user.


5

Add a group cuda to your Ubuntu, then set 750 permissions on the */dev/nvidia** devices and change the group ownership to cuda. Add those users that are granted to use the GPU to the group cuda. There are also driver parameters that do this for you during loading the nvidia driver. ( NVreg_DeviceFileGID and NVreg_DeviceFileMode ).


5

Ubuntu Firewall (ufw). See if Ubuntu Firewall is active: $ sudo ufw status If it's inactive, enable it: $ sudo ufw enable Allow SSH connections from a specific IP address: $ sudo ufw allow from 123.123.123.123 to any port 22 proto tcp Allow FTP connections $ sudo ufw allow from 123.123.123.123 to any port 21 proto tcp View firewall rules: $ sudo ...


4

1. Edit /etc/ssh/sshd_config and add these directives at the bottom: Match User guest Banner /etc/ssh/banner_guest DenyUsers guest Match all Change guest with the actual username. 2. Create the banner file: sudo nano /etc/ssh/banner_guest, and type your message inside, for example: +------------------+ | Get out of here! | +------------------+ 3....


4

The easiest way is using the firewall. DigitalOcean has a great tutorial on configuring ufw. First make sure ufw is enabled, if not enable it: sudo ufw status sudo ufw enable The relevant command for ssh/ftp from one address would be sudo ufw allow from 15.15.15.15 to any port 22 sudo ufw allow from 15.15.15.15 to any port 21 Port 22 is the defaut for ...


4

sudo chown myuser:mygroup mydir chown [-c|--changes] [-v|--verbose] [-f|--silent|--quiet] [--dereference] [-h|--no-dereference] [--preserve-root] [--from=currentowner:currentgroup] [--no-preserve-root] [-R|--recursive] [--preserve-root] [-H] [-L] [-P] {new-owner|--reference=ref-file} file ...


3

Open fstab file as using gksudo gedit /etc/fstab You should add line in /etc/fstab file as follows, /dev/sda7 /media/EXTRA ntfs-3g noauto,uid=XXX,unmask=7 0 0 Here XXX is my user id. You can find yours with id command and /dev/sda7 is the partition I want to restrict access to. Create a folder named EXTRA in /media/ as follows, sudo mkdir /media/...


3

Even though you discourage it, my suggestion is to modify your backup-script to automatically mount your disc before running backup and unmount it afterwards. There are other possibilities, which may or may not work in your case, depends on circumstances: Are you running your backup as root? Where are you mounting second HDD Do you need to have access to ...


3

You have asked a lot of similar questions. To install software you either need to be root a special account which is locked by default or an administrator. In 12.04 and later administrators are part of the group sudo in previous versions it was admin. You can check what groups a user belongs to by typing id in a terminal when logged on as that user or id ...


3

I think you're spending your effort on trifles. If Bad Guy can attach a terminal, Bad Guy can boot from his USB. But, since man securetty says securetty - file which lists terminals from which root can log in it implies that you could comment out all but TTY1. Commenting out (or not) lines for hardware you don't have makes no difference. Since, if you ...


3

Byobu can be build and installed without any root privileges. It does not need building or artifact installation outside the --prefix= directory. Following the steps your described, there is something wrong with the $HOME variable. After extracting and configuring Byobo: $ tar xf byobu_5.17.orig.tar.gz && cd byobu-5.17 && ./configure --...


2

You can use something like iptables -A OUTPUT -m owner --uid-owner 1001 to match on a local user. But this only works for users on the firewall machine. Over the network, your firewall needs to be able to identify which user is which. Normal Internet traffic has source and destination addresses only and are not tagged with usernames, which means that your ...


2

Probably you do not have permission for change permissions. By the way, in Linux any file with the execute permission is considered as executable. No matter if it actually contains anything that could be executed or not. You can set Nautilus to always open files instead of executing them. To do that just open a file manager window, go to Edit->Preferences, ...


2

There should be a better way to do this (maybe with AppArmor?) but you can always change the permissions of the executable. Suppose you want to disable access to nano. Their default permissions are as follows: ➜ ls -la /bin/nano -rwxr-xr-x 1 root root 192008 Oct 1 15:12 /bin/nano It can be executed by owner, group and others. To maintain only owner ...


2

What I ended up doing was (Similar to what you are looking for): ## PRTG monitoring Cmnd_Alias PRTG = /bin/cat /proc/loadavg, /bin/df, /var/prtg/scripts/check_proc.sh prtg ALL = NOPASSWD: PRTG Inside: /etc/sudoers.d/666-prtg (666, because... well... prtg IS a windows based monitoring tool you know)


2

Here is the improved version of my original script I've linked in the comments. This script uses all the tools that come with ubuntu, namely at(for task scheduling) , date, and gnome-session-quit so no additional installation of software is necessary. This script can be called from ~/.config/autostart or /etc/xdg/autostart in a .desktop file. date will ...


2

Since you're an experienced user, I suggest you use pam_time: The pam_time PAM module does not authenticate the user, but instead it restricts access to a system and or specific applications at various times of the day and on specific days or over various terminal lines. This module can be configured to deny access to (individual) users based on ...


2

You can't use sudo with cd. To get into protected directories, you can type sudo bash To get a root login shell or type su - To log in as root in your current shell. The behavior of both is identical, the back end differences won't matter much for what you're doing.


2

To do this, you have to edit your \etc\fstab in Linux and remove the entry/entries mounting the partitions you don't want mounted. Since they're sorted by UUID, you'll want to find out said UUID's for the partitions. sudo blkid -L will list all disks by UUID, like so: $ sudo blkid /dev/sda1: UUID="727cac18-044b-4504-87f1-a5aefa774bda" TYPE="ext4" /dev/sdb: ...


2

This is definitely possible. First, change /db-data's group to app-data: sudo chgrp -R app-data /db-data Now set up the permissions: sudo chmod -R g+rwx /db-data sudo chmod -R g-w /db-data/archived-data/* sudo find /db-data/archived-data -type d -exec 'chmod' 'g+rwx' '{}' ';' sudo chmod -R g+rwx /db-data gives app-data full permissions to /db-data and ...


2

the ifdown command can turn off your ethernet adapter.


1

"GUI for root user" is considered harmful*, but, here's an explanation of your problem: xhost tells the X Server that it may/may not accept connections from other hosts. When upstart runs your script, no user has logged in and started an X Server. Therefore, xhost has nobody to talk to. You need to delay execution of your xhost command until after you'...


1

You can limit root access in several ways: You can configure sudo to allow access to only some, but not all commands. Take care with this as sometimes this may allow shell access (for example running vim as root with sudo -> vim will then allow shell access). For details see https://www.sudo.ws/man/sudoers.man.html, there are entire sections on how to ...


Only top voted, non community-wiki answers of a minimum length are eligible