Few ?s re: Adding user/SSH/restricting

I want to set up a user that can SSH in to my box but is restricted to his home directory. So let's say I make user guest, they shouldn't be allowed to venture outside of /home/guest, or access anything outside of /home/guest period. A few questions the more I google the more I am getting confused by all the varying answers:
1. Doing useradd, what group do I put for this user guest?
2. How to do the restriction? I have read about rbash but that supposedly only locks the user out of cd'ing outside the /home/guest, but not accessing outside (ls, mv, etc.) ??
3. Say I give the user+pass for guest to a friend, he SSH's into my box, now how can I in realtime view his shell session? (Watch him cd/ls/etc.)
4. How would I terminate the SSH session of the guest myself?
Many thanks for any help

*nix is designed as multi-user, so if you just make a user that's in the users group (just use adduser if you're not sure about useradd) and they won't be able to harm anything outside of their home directory unless you have messed up the default (fairly secure) settings. You might want to set up quotas if you're worried about them filling /tmp, /home or the various world-writable directories in /var.
Completing taking away read access from /usr, /bin, etc. would stop them from running anything. Just make sure your home directory is set to 700 permissions and you don't have anything private outside of there.
question 3 can be answered by a quick google search:
http://serverfault.com/questions/12419/ … -real-time
4. pkill, kill, killall? or just kill sshd
Last edited by thestinger (2011-01-12 04:38:35)

Similar Messages

What is the difference between using the command "dsmgmt" and the "Managed By" tab when adding users to the local administrators Account on a Read-Only Domain Controller?

When I use the
"dsmgmt" command to add a user to the local administrators account of a RODC I can actually see the user when I use the "Show Role Administrators" parameter. However, I can't see the members of the
group added to the "Managed By" tab of the RODC object in AD. Even though, the users added using
"dsmgmt" and by the "Managed By" tab can all log in locally and have admin rights to the RODC. Are there any differences between these two ways of adding users to the local administrators account?

Hi,
For groups, managedBy is an administrative convenience to designate “group admins”. Whatever principal listed in
managedBy gets permission to update a group’s membership (the actual security is updated on the group’s AD object to allow this).
In Win2008 and later managedBy also became the way you delegated local administration on an RODC, allowing branch admins to install patches, manage shares, etc. (http://technet.microsoft.com/en-us/library/cc755310(WS.10).aspx).
On the RODC, this is updating the RepairAdmin registry value within RODCRoles.
So the difference between them should be only the way they do the same thing.
For more details, please refer to the below article:
http://blogs.technet.com/b/askds/archive/2011/06/24/friday-mail-sack-wahoo-edition.aspx
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Can't log on with administrator user by finding the message "The task you are trying to do can't be completed because Remote Desktop Services is currently busy. Please try again in a few minutes. Other users should still be able to log on.

Hi,
Now, my Windows 2008 R2 Enterprise server are running in the domain. It have problem about some one in my team have remote my server with the user administrator while I'm remote it now. It make my session loss. I tried to remote it again but I found
the message at the log on screen about "The task you are trying to do can't be completed because Remote Desktop Services is currently busy. Please try again in a few minutes. Other users should still be able to log on."
Now, nobody can't remote with administrator user into this server. I have check the application log. I found the error message like this.
++++++++++++++++++++++++++++
Source: Desktop Window Manager
Event ID: 9003
Detail: None The Desktop Window Manager was unable to start because a composited theme is not in use
++++++++++++++++++++++++++++
Source: Microsoft-Windows-Winsrv
Event ID:10002
Detail: The following application was terminated because it was hung: mmc.exe.
++++++++++++++++++++++++++++
Source: Microsoft-Windows-Winsrv
Event ID:10002
Detail: The following application was terminated because it was hung: javaw.exe.
++++++++++++++++++++++++++++
Source: Microsoft-Windows-Winsrv
Event ID:10002
Detail: The following application was terminated because it was hung: Explorer.exe.
++++++++++++++++++++++++++++
Source:Desktop Window Manager
Event ID:9009
Detail:The Desktop Window Manager has exited with code (0x40010004)
++++++++++++++++++++++++++++
Source:Microsoft-Windows-Winlogon
Event ID:6005
Detail:The winlogon notification subscriber <Sens> is taking long time to handle the notification event (Logoff).
++++++++++++++++++++++++++++
In addition, I can log on this server with other user but I can't log off by it's showing the message "please wait for the system Event Notification service". Normally, the problem can solve by reboot the server. But how can be solve this problem
by we do not reboot the server?

Hi,
The cause of unable to remote back to the server seems to be services hung, please try to reset session as the article below guides to see if it works:
Windows Server: Remote Desktop Error: The task you are trying to do can't be completed because Remote Desktop Services is currently busy
http://social.technet.microsoft.com/wiki/contents/articles/28636.windows-server-remote-desktop-error-the-task-you-are-trying-to-do-can-t-be-completed-because-remote-desktop-services-is-currently-busy.aspx
If the issue can always be re-produced, then I would suggest you fully patch the system.
More information for you:
The task you are trying to do can't be completed because Remote Desktop Services is currently busy. Please try again in a few minutes. Other users should still be able to log on
https://social.technet.microsoft.com/Forums/windows/en-US/c58bfbd5-1d63-47e3-a489-6d8c8778b76b/the-task-you-are-trying-to-do-cant-be-completed-because-remote-desktop-services-is-currently-busy?forum=winserverTS
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Error while Adding user to 'SunAccessManager' Resource

Hi,
I configured SAM Resource adapter in SIM 6.0. When I create a user and assign SAM Resource getting the following Error,
com.waveset.util.WavesetException: An error occurred adding user 'uid=SIMUser2,ou=People,o=Employee,dc=nl,dc=dap,dc=com' to resource 'SunAccessManager'. com.waveset.util.WavesetException: An error occurred creating user. java.lang.IllegalArgumentException: Invalid parameters
Pls help me to resolve this issue
Thanks,
Deva

Hi Satish,
The problem is that you added the table and the objetc that you used to add the table is not freed properly. You need to free the object and then the reference count to that table will be 0 - which will enable you to add the fields
e.g
Dim pUTables As SAPbobsCOM.UserTablesMD
'Do your stuff
Set pUTables = Nothing
Dim pUFields As SAPbobsCOM.UserFieldsMD
'Do your stuff
Set pUFields = Nothing

Adding users programmatically -- almost there

... getting close...
Create this procedure in the PORTAL schema.
It works if you call it when connected as PORTAL, but not when connected as anyone else.
It is throwing a user-defined exception frmo inside WWCTX_SSO, so I am guessing that it is looking at the session context and deciding that the SESSION_USER shouldn't be adding users.
Perhaps a true PL/SQL wiz can pick up the ball and figure out what is going on.
FYI this is sandbox code at its grittiest, so don't even think of pasting it into your application 8^)
create or replace procedure ci_add_portal_user
(uname in varchar2,pwd in varchar2, email in varchar2,lname in varchar2,fname in varchar2,clr_lvl in integer)
as
l_guid varchar2(32);
p_user_id number;
sess dbms_ldap.session;
err_code number;
err_msg varchar2(300);
INVALID_GRP_NAME_EXCEPTION exception;
INVALID_SITE_EXCEPTION exception;
VALUE_ERROR_EXCEPTION exception;
DUPLICATE_GROUP_EXCEPTION exception;
GROUP_NOT_FOUND_EXCEPTION exception;
GROUP_MEMBER_EXCEPTION exception;
GROUP_NOT_UNIQUE_EXCEPTION exception;
USER_NOT_FOUND_EXCEPTION exception;
USER_EXISTS_EXCEPTION exception;
APP_NOT_FOUND_EXCEPTION exception;
NO_MANAGER_EXCEPTION exception;
DUPLICATE_GRANTEE_EXCEPTION exception;
NO_ACCESSIBLE_OBJECT_EXCEPTION exception;
ORG_NOT_EXIST_EXCEPTION exception;
INVALID_PERSON_ID_EXCEPTION exception;
ACCESS_DENIED_EXCEPTION exception;
CIRCULAR_REFERENCE_EXCEPTION exception;
UNEXPECTED_EXCEPTION exception;
USER_NOT_DELETABLE_EXCEPTION exception;
INVALID_ARGUMENT_EXCEPTION exception;
INVALID_AUTH_FUNC_EXCEPTION exception;
LDAP_CONNECTION_EXCEPTION exception;
DEPRECATED_API_EXCEPTION exception;
INVALID_ARGUMENT_EXCEPTION exception;
BEGIN
/* Create SSO User */
begin
l_guid := portal.wwsec_oid.create_user_entry
p_base => portal.wwsec_oid.get_user_search_base,
p_user_name => uname,
p_password => pwd,
p_email => email,
p_first_name => fname,
p_last_name => lname,
p_create_state => null,
p_bind_as_user => false
exception when others then
err_code:=SQLCODE;
err_msg:=SQLERRM;
dbms_output.put_line(' Exception :'||err_code||' '||err_msg);
end;
/* Create Portal User */
begin
p_user_id:=portal.wwsec_api.id_sso(p_username=>uname);
dbms_output.put_line('USER ==>'||p_user_id||' '||portal.wwsec_api.user_name(p_user_id));
exception when others then
err_code:=SQLCODE;
err_msg:=SQLERRM;
dbms_output.put_line(' Exception :'||err_code||' '||err_msg);
end;
begin
portal.wwsec_api.add_user_to_list(p_user_id,portal.wwsec_api.group_id('CI_USR'),0);
portal.wwsec_api.set_defaultgroup(portal.wwsec_api.group_id('CI_USR'),uname);
exception when others then
err_code:=SQLCODE;
err_msg:=SQLERRM;
dbms_output.put_line(' Exception :'||err_code||' '||err_msg);
end;
begin
portal.wwsec_api.add_user_to_list(p_user_id,portal.wwsec_api.group_id('CI_CLR_'||clr_lvl),0);
exception when others then
err_code:=SQLCODE;
err_msg:=SQLERRM;
dbms_output.put_line(' Exception :'||err_code||' '||err_msg);
end;
END ci_add_portal_user;

Andrew,
to add a user to a specific group in the FileRealm, try doing the following:
import java.security.acl.Group;
import weblogic.security.acl.BasicRealm;
import weblogic.security.acl.ManageableRealm;
import weblogic.security.acl.Security;
// Create a user in WebLogic
BasicRealm bRealm = Security.getRealm();
ManageableRealm mRealm = (ManageableRealm)bRealm;
if (null == mRealm) { throw new SecurityException("Security Realm is null");
weblogic.security.acl.User oNewUser = mRealm.newUser("username", "password",
null);
// -- Put the new user into the selected group
Enumeration eGroups = mRealm.getGroups();
Group oGroup = mRealm.getGroup("group name you want to add to");
if (null != oGroup) {
oGroup.addMember(oNewUser);
try { mRealm.save("FileRealm.Properties"); } catch (IOException e) { }
Andrew Dunn <[email protected]> wrote:
Thanks, Mike.
I'm trying to use the Default realm in WLS7.0 (which uses LDAP), so
I'm looking for the classes specific to the Default realm - I assume
BEA provides some, but I can't find them in the docs.
On 2 Dec 2002 10:15:18 -0800, "mike" <[email protected]>
wrote:
You will not find implementing classes in general. The thing is thatthey (classes)
are specific to particular implementation of realm you are using (assumingyou
use 6.x or below, but that is logically true for 7). So you need tofind what
are the classes used in your realm and work with those. If you are usingan implementation
shipped with WLS (eg. FIleRealm or LDAP) you will have to use reflection...
Andrew Dunn <[email protected]> wrote:
How can I add users/groups via the Weblogic API? All I can find in
the documenattion is interfaces, but no implementation classes. How
can I instantiate the classes?
Thanks, Andrew

Adding users to groups

Hi,
can any one share documents/resources pertaining to how to create sap user groups in BOE.
how to add groups to users.
how to import sap users.
etc

Hi,
You can find the product documentation here:
http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000713358&_SCENARIO=01100035870000000202&
Specifically, go to the "Integration for SAP Solutions" section and take a look at the Installation and Administration guide:
https://websmp210.sap-ag.de/~sapidb/011000358700000559912010E/xi31_sp3_bip_sap_inst_en.pdf
As far as adding users and groups to the system, this is down through the CMC. The Business Objects Enterprise Administrators guide should help you with these tasks:
http://help.sap.com/businessobject/product_guides/boexir31SP3/en/xi31_sp3_bip_admin_en.pdf
To add users/groups to the BOE system, you have to go into the CMC/Authentication section and click on the SAP tab. In here, you configure your SAP system information and add the groups that you wish to import into BOE. Once you add the groups through here, the user accounts and groups will be mapped in to the Users and Groups section of the CMC. From here, you can treat them like any other group in the system.
You add users to the SAP groups the same way you would for BW or any other SAP product. If a new user is added to an SAP group that is imported into BOE, then that user will be able to logon to the BOE system.
We also have many notes on these subjects.
thanks
Jonathan

SP 2010-After adding user from IIS is not found in central admin

Hi Experts,
I am trying to configure my SP 2010 with Form Based Authentication.
After configuring WebSite, STS and Central Admin I added the user from IIS , But not able to found from central admin in Form Authentication.
I checked in database the user is added.
I followed the below blog .
http://jasear.wordpress.com/2012/03/16/sharepoint-2010-setting-up-form-based-authentication-fba-using-asp-net-sql-membership-provider/
Can experts help me how to get the added user to central admin.
Thanks
AshisK

I was finally able to get the FBA working. After many failed attempts, I knew there was a configuration issue which was causing the error.
I provided connection string and provider details at 4 places, instead of the 3 mentioned in various blogs around ->
1. Sharepoint Central Admin
2. Sharepoint Web Services
3. SecurityTokenServiceApplication
4. And finally the web application itself.
The connection string for 2nd and 3rd will remain same however, provider details need to be added.
After completing this step, I was able to login using Form Based Authentication without an issue.
AshisK

Adding users using XML

The examples for adding users to iFS work fine, but do I have to create an XML file for every user I want to add? I tried to create an XML file with more than one <SimpleUser> definitions, but iFS reports an "unexpected end of file" error at the position where the second User definition starts.

<BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>Originally posted by jsacks:
Ralf,
Using the standard <object_list> tag to parse a list of simpleuser tags should work:
<HR></BLOCKQUOTE>
Included inside <objectlist> tags, it works fine. Thank you very much.
null

Suddenly getting 404 error when adding user to group

Hi,
I have an OAM 10.1.4.0.1 instance that's been working fine.
However, today, I noticed that when I tried to add a user to a group, when I am in the selector page and click a user, I then get an HTTP 404 error.
I've searched all of the log files that I can find, and I can't see any error messages. The only thing that is showing an error in a log is the IIS that I have setup with WebGate for OAM Admin. I get a "404" error with a sc-win32-status or "3".
I have restarted everything, and that still hasn't helped.
Does anyone here know what might be causing this, or how to diagnose the problem?
Thanks,
Jim

Hi,
I'm answering my own question/problem here, but hopefully this info will help someone else.
I was able to get adding users to groups working again. I found that after I cleared the cache in my browser (IE6), the "add user to groups" started working again, without the HTTP 404 error.
In hindsight, I guess this kind of makes sense, because if you ever watch the URIs on the selector pages, they all look alike, so I'm guessing the IE would not send a full GET request, but the "content" was no longer valid on the OAM server, thus the 404 error.
Jim

Error when manually adding user to project workspace

I am currently using Project Server 2010. I have a requirement for Business Users to have access to the project workspaces in Sharepoint but not be users of the PWA. Similar to as it is outlined in this Microsoft Documentation (http://technet.microsoft.com/en-us/library/cc197668(v=office.14).aspx)
There might be a circumstance where you want to grant people who are not members of the project access to the project workspace site. Anyone assigned to the Web Administrator group can create new users for a project workspace site. In addition to the
four groups that were mentioned earlier, there are four default SharePoint Server 2010 groups. They are as follows:
Full Control   Has all personal, site, and list permissions.
Design   Can edit lists, document libraries, and pages in the Web site.
Contribute   Can view pages and edit list items and documents.
Read   Can view pages, list items, and documents.
I have added the user to the Contributor group but when they try to contribute to the space, ie add documents or an issue/risk, they recieve an error, similar to as is documented in the following article (http://pwmather.wordpress.com/2011/07/11/manually-adding-users-to-project-workspace-project-site-in-projectserver-ps2010-ps2007-epm/)
What has been identified in this article makes sense.  I am just wondering why Microsoft documentation states that it can be done.
Any thoughts?

Chris,
The Microsoft article says, users who are not part of the project. It does not say not part of project server.
However, as far as I can remember, this scenario could work if the "Synchronization" is turned off between Project Server and Project Sites. I will run a test and confirm, later today.
Prasanna Adavi,PMP,MCTS,MCITP,MCT TWitter: @prasannaadavi Blog: http://www.prasannaadavi.com

Adding Users in OIM using SPML

Hi,
In our project we have a requirement where we have to create a user in OID/OIM. The existing code connects to OIMProvisioning using SPML to search, add and modify users. In SPML we couldn’t find any basedn being set while adding user or searching for user.
a. It would be helpful if someone who has knowledge on OID/OIM and SPML to let me know how to query or add users in a specific BaseDN using SPML.
b. I would like to know if it is possible to update both OID and OIM using SPML.
Regards
Philip

It may help you:
http://www.youtube.com/watch?v=7C8cI5zc1DM

When updating to target only few records got added to the target

When updating to target only few records got added to the target from the transferred recordsu2026what could be the reason?
Edited by: MohanDP on Jun 28, 2010 7:44 PM

Hi Mohan,
When updating to target only few records got added to the target from the transferred recordsu2026what could be the reason
There might be a routine in your Transformation which might be filtering few records(or)
It is possible that you will have multiple records for one keyfield in PSA. But when you try loading the same to datatarget like Cube, the result will be added.
For ex, say you have Profit center US00000593 in PSA with two rows with keyfigure(say some ABC) values 100 & -50.
Then when you load the data to datatarget, you will have only one row in it with Profit center US00000593 & values for keyfigure ABC=50 (i.e 100-50=50). So most of the times we will be having added records less than transferred records.
Hope it is clear!
Regards,
Pavan

Copy few test assignment with User from one database instance to another

Hi,
I have OTL ,Payroll and HRMS system. I want to Copy few test assignment with User(Few FND Users) from one database instance to another .
Source: DEV Instance
OTL users to enter their Time sheet
OTL is intergated with HRMS to pickup Employee information
Existing business users are integrated with Employee assignment etc tables to pickup person_id
Target: Want to copy few test OTL users from ONE instance to another. Bringing FND_User is easy but EMPLOYEE_ID, PERSON_PART_ID will not come during FNDLOADER .
How to bring all information from one instance to another instance? Please advice.
thanks .

Dear,
Try using HRMS configuration workbench. For this you might require support from your DBA for configuring the same. Once configured, you can move the items you want.
Regards,
Kathan

Adding users in FDQM

Hi All,
I have around 100 users in the system whom i have provisioned in shared services giving Intermediate-2 access in FDQM. I am aware that to add these users in FDQM i have to do it using Administration menu -> User maintenance .
However, since doing this task (adding user + giving access to locations) is tedious to do for 100 users manually, is it possible to do the same using some kind file upload / automatically with minimal efforts?

It may help you:
http://www.youtube.com/watch?v=7C8cI5zc1DM

Can't download mozilla. says user account restriction.

The scroll bar was not working properly so I uninstalled mozilla and am trying to reinstall the program, but it won't allow me. I get logon failure notice and it states user account restriction.

Andrew, the OP said he has '''2.3.6''' when Google Play says 2.3 is the minimum. It has been Android '''2.3''' since Firefox '''31.0''' release.
What phone or tablet is it as while it has 2.3+ it may have some performance issues.

Few ?s re: Adding user/SSH/restricting

Similar Messages

Maybe you are looking for