What do you mean by "solution"? Do you want to stop people from logging in when they have the correct password?
You should make your passwords strong enough so that people cannot (easily) guess/hack them. Don't allow people to log in as root remotely. You can limit where people can log in from by using iptables.
Tom
Tom Spec wrote:
What do you mean by "solution"? Do you want to stop people from logging in when they have the correct password?
You should make your passwords strong enough so that people cannot (easily) guess/hack them. Don't allow people to log in as root remotely. You can limit where people can log in from by using iptables.
Tom
If there is ssh-telnet service for user... Then is there a solution to fix the problem of hack ( although someone who know the user's password, but they can't modify / delete any profile files, so the user who can login to the server nect time again ) ? eg : limit user profile ( user account ) ? if so, how to do this ?
Edward.
edwardspl@ita.org.mo wrote:
Tom Spec wrote:
What do you mean by "solution"? Do you want to stop people from logging in when they have the correct password?
You should make your passwords strong enough so that people cannot (easily) guess/hack them. Don't allow people to log in as root remotely. You can limit where people can log in from by using iptables.
Tom
If there is ssh-telnet service for user... Then is there a solution to fix the problem of hack ( although someone who know the user's password, but they can't modify / delete any profile files, so the user who can login to the server nect time again ) ? eg : limit user profile ( user account ) ? if so, how to do this ?
Edward.
I think the real solution is to teach your user that it is important not to let others know his password if he hasn't figured that out himself yet. And if others do need this access they should have their own accounts instead of being able to pretend to be someone else.
On 08/02/07, Les Mikesell lesmikesell@gmail.com wrote:
I think the real solution is to teach your user that it is important not to let others know his password if he hasn't figured that out himself yet. And if others do need this access they should have their own accounts instead of being able to pretend to be someone else.
A better solution might be to gently widen the space between the chair and the keyboard, remove anything you find on the chair, and then replace the chair to it's former position. This should eliminate the most failure-prone of components in your particular system.
Dotan Cohen
http://what-is-what.com/what_is/internet.html http://dramatherapist.info
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
Tom Spec wrote:
What do you mean by "solution"? Do you want to stop people from logging in when they have the correct password?
You should make your passwords strong enough so that people cannot (easily) guess/hack them. Don't allow people to log in as root remotely. You can limit where people can log in from by using iptables.
Tom
If there is ssh-telnet service for user... Then is there a solution to fix the problem of hack ( although someone who know the user's password, but they can't modify / delete any profile files, so the user who can login to the server nect time again ) ? eg : limit user profile ( user account ) ? if so, how to do this ?
Edward.
I think the real solution is to teach your user that it is important not to let others know his password if he hasn't figured that out himself yet. And if others do need this access they should have their own accounts instead of being able to pretend to be someone else.
Hello,
But I think the user account ( profile files ) is also problem, so, I want to know how limit the related files ( including the dot file ) !
Edward.
edwardspl@ita.org.mo wrote:
I think the real solution is to teach your user that it is important not to let others know his password if he hasn't figured that out himself yet. And if others do need this access they should have their own accounts instead of being able to pretend to be someone else.
But I think the user account ( profile files ) is also problem, so, I want to know how limit the related files ( including the dot file ) !
This was covered in another topic. Using normal unix permissions: https://www.redhat.com/archives/fedora-list/2007-February/msg01197.html or with the special chattr operation: https://www.redhat.com/archives/fedora-list/2007-February/msg01247.html
You'll have to fix them for the existing broken account first, though. Either delete the account and re-add it or copy working versions of the files over from a working account as root.
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
I think the real solution is to teach your user that it is important not to let others know his password if he hasn't figured that out himself yet. And if others do need this access they should have their own accounts instead of being able to pretend to be someone else.
But I think the user account ( profile files ) is also problem, so, I want to know how limit the related files ( including the dot file ) !
This was covered in another topic. Using normal unix permissions: https://www.redhat.com/archives/fedora-list/2007-February/msg01197.html or with the special chattr operation: https://www.redhat.com/archives/fedora-list/2007-February/msg01247.html
You'll have to fix them for the existing broken account first, though. Either delete the account and re-add it or copy working versions of the files over from a working account as root.
Hello to you,
1, The System is FC6. 2, After run "adduser edward" and login with user "edward", then
[edward@svr1 ~]$ ls -l -a total 36 drwx------ 3 edward edward 4096 Feb 6 22:51 . drwxr-xr-x 5 root root 4096 Feb 6 22:50 .. -rw------- 1 edward edward 67 Feb 7 12:47 .bash_history -rw-r--r-- 1 edward edward 24 Feb 6 22:50 .bash_logout -rw-r--r-- 1 edward edward 176 Feb 7 11:57 .bash_profile -rw-r--r-- 1 edward edward 124 Feb 6 22:50 .bashrc drwxr-xr-x 3 edward edward 4096 Feb 6 22:50 .kde -rw-r--r-- 1 edward edward 658 Feb 6 22:50 .zshrc [edward@svr1 ~]$
3, Is it : chown root /home/edward chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward chmod +t ( What number of +t ) /home/edward chown root /home/edward/ All_dot_filenames
Edward.
edwardspl@ita.org.mo wrote:
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
I think the real solution is to teach your user that it is important not to let others know his password if he hasn't figured that out himself yet. And if others do need this access they should have their own accounts instead of being able to pretend to be someone else.
But I think the user account ( profile files ) is also problem, so, I want to know how limit the related files ( including the dot file ) !
This was covered in another topic. Using normal unix permissions: https://www.redhat.com/archives/fedora-list/2007-February/msg01197.html or with the special chattr operation: https://www.redhat.com/archives/fedora-list/2007-February/msg01247.html
You'll have to fix them for the existing broken account first, though. Either delete the account and re-add it or copy working versions of the files over from a working account as root.
Hello to you,
1, The System is FC6. 2, After run "adduser edward" and login with user "edward", then
You'll need to do most of this as root.
[edward@svr1 ~]$ ls -l -a total 36 drwx------ 3 edward edward 4096 Feb 6 22:51 . drwxr-xr-x 5 root root 4096 Feb 6 22:50 .. -rw------- 1 edward edward 67 Feb 7 12:47 .bash_history -rw-r--r-- 1 edward edward 24 Feb 6 22:50 .bash_logout -rw-r--r-- 1 edward edward 176 Feb 7 11:57 .bash_profile -rw-r--r-- 1 edward edward 124 Feb 6 22:50 .bashrc drwxr-xr-x 3 edward edward 4096 Feb 6 22:50 .kde -rw-r--r-- 1 edward edward 658 Feb 6 22:50 .zshrc [edward@svr1 ~]$
3, Is it : chown root /home/edward chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
You can use the symbolic form literally. I think it's easier to understand. Let the computer do the binary/octal math. g+rwx means add the read, write, and execute bits for the group.
chmod +t ( What number of +t ) /home/edward
Same here, you can type it that way and it means add the "sticky" bit.
chown root /home/edward/ All_dot_filenames
Don't get carried away with wildcards on this one. .* will also match .. which is your parent directory.
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
I think the real solution is to teach your user that it is important not to let others know his password if he hasn't figured that out himself yet. And if others do need this access they should have their own accounts instead of being able to pretend to be someone else.
But I think the user account ( profile files ) is also problem, so, I want to know how limit the related files ( including the dot file ) !
This was covered in another topic. Using normal unix permissions: https://www.redhat.com/archives/fedora-list/2007-February/msg01197.html or with the special chattr operation: https://www.redhat.com/archives/fedora-list/2007-February/msg01247.html
You'll have to fix them for the existing broken account first, though. Either delete the account and re-add it or copy working versions of the files over from a working account as root.
Hello to you,
1, The System is FC6. 2, After run "adduser edward" and login with user "edward", then
You'll need to do most of this as root.
[edward@svr1 ~]$ ls -l -a total 36 drwx------ 3 edward edward 4096 Feb 6 22:51 . drwxr-xr-x 5 root root 4096 Feb 6 22:50 .. -rw------- 1 edward edward 67 Feb 7 12:47 .bash_history -rw-r--r-- 1 edward edward 24 Feb 6 22:50 .bash_logout -rw-r--r-- 1 edward edward 176 Feb 7 11:57 .bash_profile -rw-r--r-- 1 edward edward 124 Feb 6 22:50 .bashrc drwxr-xr-x 3 edward edward 4096 Feb 6 22:50 .kde -rw-r--r-- 1 edward edward 658 Feb 6 22:50 .zshrc [edward@svr1 ~]$
3, Is it : chown root /home/edward chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
You can use the symbolic form literally. I think it's easier to understand. Let the computer do the binary/octal math. g+rwx means add the read, write, and execute bits for the group.
But I want to know what no of g+rwx...
chmod +t ( What number of +t ) /home/edward
Same here, you can type it that way and it means add the "sticky" bit.
Also want to know...
chown root /home/edward/ All_dot_filenames
Don't get carried away with wildcards on this one. .* will also match .. which is your parent directory.
ok, chown root /home/edward/.*
Edward.
On Thu, 2007-02-08 at 16:38 +0800, edwardspl@ita.org.mo wrote:
But I want to know what no of g+rwx
The RWX bits are binary flags in most significant order.
Some examples: RWX = 111 (binary) RW- = 110 (binary)
The least-significant bit (rightmost) is worth one, the middle is worth 2, the most significant bit is worth four.
Some examples: RWX = 4 + 2 + 1 = 7 (decimal) R-X = 4 + 0 + 1 = 6 (decimal) R-- = 4 + 0 + 0 = 4 (decimal)
Since we're only counting up as far as 7, you can use those numbers directly as octal. From 0 to 7, octal, hexadecimal, and decimal numbers are all represented by the same symbols.
As above with RWX=7 and R=4, u=RWX, g=RWX o=R-- (user, group, others) = 0774 (octal, with a leading zero to indicate that it is octal)
Tim wrote:
On Thu, 2007-02-08 at 16:38 +0800, edwardspl@ita.org.mo wrote:
But I want to know what no of g+rwx
The RWX bits are binary flags in most significant order.
Some examples: RWX = 111 (binary) RW- = 110 (binary)
The least-significant bit (rightmost) is worth one, the middle is worth 2, the most significant bit is worth four.
Some examples: RWX = 4 + 2 + 1 = 7 (decimal) R-X = 4 + 0 + 1 = 6 (decimal) R-- = 4 + 0 + 0 = 4 (decimal)
Since we're only counting up as far as 7, you can use those numbers directly as octal. From 0 to 7, octal, hexadecimal, and decimal numbers are all represented by the same symbols.
As above with RWX=7 and R=4, u=RWX, g=RWX o=R-- (user, group, others) = 0774 (octal, with a leading zero to indicate that it is octal)
Hello,
So...What no for the following setting ? 1, g+rwx 2, +t
Edward.
On Thu, 2007-02-08 at 20:36 +0800, edwardspl@ita.org.mo wrote:
So...What no for the following setting ? 1, g+rwx 2, +t
You can work them out for yourself by reading the chmod man page. The information you need is in there, without having to wait for us to reply, or make a mistake and post misleading information without noticing it.
But I have to ask: Why bother trying to *work* out what binary represents g=rwx, instead of actually using g=rwx, directly? Likewise, for the sticky bit. What's the point?
edwardspl@ita.org.mo wrote:
chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
You can use the symbolic form literally. I think it's easier to understand. Let the computer do the binary/octal math. g+rwx means add the read, write, and execute bits for the group.
But I want to know what no of g+rwx...
The + means it is added to the bits already permitted. Look at them as groups of 3 bits in binary and take the octal value.
user group other rwx rwx rwx
You'll start with a home dir having rwx --- --- so that's 111 000 000 binary or 700 octal. Add the group rwx and you get 111 111 000 or 770 octal
chmod +t ( What number of +t ) /home/edward
That's one more bit to the left, 1 000 000 000 binary, so 1000 octal. Add that to what you have.
Same here, you can type it that way and it means add the "sticky" bit.
Also want to know...
Altogether, the octal value for the mode ends up at 1770. But, as I said before the computer does a better job of thinking in octal.
chown root /home/edward/ All_dot_filenames
Don't get carried away with wildcards on this one. .* will also match .. which is your parent directory.
ok, chown root /home/edward/.*
I meant not to do that. In this case it won't break anything because the parent (..) dir of /home/edward will alread be owned by root, but it is a bad idea in general to wildcard .*
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
You can use the symbolic form literally. I think it's easier to understand. Let the computer do the binary/octal math. g+rwx means add the read, write, and execute bits for the group.
But I want to know what no of g+rwx...
The + means it is added to the bits already permitted. Look at them as groups of 3 bits in binary and take the octal value.
user group other rwx rwx rwx
You'll start with a home dir having rwx --- --- so that's 111 000 000 binary or 700 octal. Add the group rwx and you get 111 111 000 or 770 octal
So, g+rwx = 770, right ?
chmod +t ( What number of +t ) /home/edward
That's one more bit to the left, 1 000 000 000 binary, so 1000 octal. Add that to what you have.
Same here, you can type it that way and it means add the "sticky" bit.
Also want to know...
Altogether, the octal value for the mode ends up at 1770. But, as I said before the computer does a better job of thinking in octal.
So, +t = 1770, right ?
Edward.
edwardspl@ita.org.mo wrote:
chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
You can use the symbolic form literally. I think it's easier to understand. Let the computer do the binary/octal math. g+rwx means add the read, write, and execute bits for the group.
But I want to know what no of g+rwx...
The + means it is added to the bits already permitted. Look at them as groups of 3 bits in binary and take the octal value.
user group other rwx rwx rwx
You'll start with a home dir having rwx --- --- so that's 111 000 000 binary or 700 octal. Add the group rwx and you get 111 111 000 or 770 octal
So, g+rwx = 770, right ?
No.. Literally it means to add the 2nd 7 (the ---rwx--- positions) to whatever was there before. In the case of a typical home directory it will be 770 because the first 7 ( rwx------) was already there.
chmod +t ( What number of +t ) /home/edward
That's one more bit to the left, 1 000 000 000 binary, so 1000 octal. Add that to what you have.
Same here, you can type it that way and it means add the "sticky" bit.
Also want to know...
Altogether, the octal value for the mode ends up at 1770. But, as I said before the computer does a better job of thinking in octal.
So, +t = 1770, right ?
Again, that is the case where you already have 770 set, but +t really means to add the 1000 bit to whatever was there. You can also specify absolute settings in the symbolic style: chmod u=rwx,g=rwx,o=t file... will set 1770 regardless of what is there and is easier to understand. See 'man chmod' for more details, but it helps to know that the modes are simply bits where 1 gives the permission, 0 does not. The values you compute in octal show the combinations of the bits but they really each only have their own independent meaning so I think the symbolic form makes more sense.
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
You can use the symbolic form literally. I think it's easier to understand. Let the computer do the binary/octal math. g+rwx means add the read, write, and execute bits for the group.
But I want to know what no of g+rwx...
The + means it is added to the bits already permitted. Look at them as groups of 3 bits in binary and take the octal value.
user group other rwx rwx rwx
You'll start with a home dir having rwx --- --- so that's 111 000 000 binary or 700 octal. Add the group rwx and you get 111 111 000 or 770 octal
So, g+rwx = 770, right ?
No.. Literally it means to add the 2nd 7 (the ---rwx--- positions) to whatever was there before. In the case of a typical home directory it will be 770 because the first 7 ( rwx------) was already there.
So... what is the correct no for the pression limitation ? Or may be chmod g+770
That's one more bit to the left, 1 000 000 000 binary, so 1000 octal. Add that to what you have.
Same here, you can type it that way and it means add the "sticky" bit.
Also want to know...
Altogether, the octal value for the mode ends up at 1770. But, as I said before the computer does a better job of thinking in octal.
So, +t = 1770, right ?
chmod +t ( What number of +t ) /home/edward
Again, that is the case where you already have 770 set, but +t really means to add the 1000 bit to whatever was there. You can also specify absolute settings in the symbolic style: chmod u=rwx,g=rwx,o=t file... will set 1770 regardless of what is there and is easier to understand. See 'man chmod' for more details, but it helps to know that the modes are simply bits where 1 gives the permission, 0 does not. The values you compute in octal show the combinations of the bits but they really each only have their own independent meaning so I think the symbolic form makes more sense.
So... is it correct ?
edwardspl@ita.org.mo wrote:
> chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
said before the computer does a better job of thinking in octal.
So, +t = 1770, right ?
chmod +t ( What number of +t ) /home/edward
Again, that is the case where you already have 770 set, but +t really means to add the 1000 bit to whatever was there. You can also specify absolute settings in the symbolic style: chmod u=rwx,g=rwx,o=t file... will set 1770 regardless of what is there and is easier to understand. See 'man chmod' for more details, but it helps to know that the modes are simply bits where 1 gives the permission, 0 does not. The values you compute in octal show the combinations of the bits but they really each only have their own independent meaning so I think the symbolic form makes more sense.
So... is it correct ?
If you start with
drwx------ /home/edward the commands
chmod g+rwx /home/edward chmod +t /home/edward or chmod u=rwx,g=rwx,o=t /home/edward or chmod 1770 /home/edward
will all give you the same result: drwxrwx---T /home/edward
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
>>chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward >> >>
said before the computer does a better job of thinking in octal.
So, +t = 1770, right ?
chmod +t ( What number of +t ) /home/edward
Again, that is the case where you already have 770 set, but +t really means to add the 1000 bit to whatever was there. You can also specify absolute settings in the symbolic style: chmod u=rwx,g=rwx,o=t file... will set 1770 regardless of what is there and is easier to understand. See 'man chmod' for more details, but it helps to know that the modes are simply bits where 1 gives the permission, 0 does not. The values you compute in octal show the combinations of the bits but they really each only have their own independent meaning so I think the symbolic form makes more sense.
So... is it correct ?
If you start with
drwx------ /home/edward the commands
chmod g+rwx /home/edward chmod +t /home/edward or chmod u=rwx,g=rwx,o=t /home/edward or chmod 1770 /home/edward
will all give you the same result: drwxrwx---T /home/edward
So.. only chmod 1770 /home/edward
edwardspl@ita.org.mo wrote:
So... is it correct ?
If you start with
drwx------ /home/edward the commands
chmod g+rwx /home/edward chmod +t /home/edward or chmod u=rwx,g=rwx,o=t /home/edward or chmod 1770 /home/edward
will all give you the same result: drwxrwx---T /home/edward
So.. only chmod 1770 /home/edward
It's your choice. The permission bits are the same any way you say it, but it is best to use the way that you understand and do an 'ls -ld' on the directory after the chmod to be sure it is right. Remember, the object of this is to set the directory owner/modes so that the user can still create/remove his own files but can't remove/replace certain files that you will chown to root.
On Fri, 2007-02-09 at 09:44 -0600, Les Mikesell wrote:
Remember, the object of this is to set the directory owner/modes so that the user can still create/remove his own files but can't remove/replace certain files that you will chown to root.
I am curious whether a user can cause system problems by modifying their own files?
Tim wrote:
On Fri, 2007-02-09 at 09:44 -0600, Les Mikesell wrote:
Remember, the object of this is to set the directory owner/modes so that the user can still create/remove his own files but can't remove/replace certain files that you will chown to root.
I am curious whether a user can cause system problems by modifying their own files?
Someone recommend disable ssh / telnet service and do the limitation for FTP Service...
Tim wrote:
Remember, the object of this is to set the directory owner/modes so that the user can still create/remove his own files but can't remove/replace certain files that you will chown to root.
I am curious whether a user can cause system problems by modifying their own files?
Generally not, but they can get in a state where their own login does not work. I think this thread started in regard to someone other than the real user getting access and damaging some files.
Tim:
I am curious whether a user can cause system problems by modifying their own files?
Les Mikesell:
Generally not, but they can get in a state where their own login does not work. I think this thread started in regard to someone other than the real user getting access and damaging some files.
I seem to recall that, though I think that's another problem that needs addressing in itself (I can't remember if it was). I could also imagine a novice user messing up their own files. But didn't think they'd be able to cause problems to the system or other users with their own.
On Sat, 2007-02-10 at 01:19 -0600, Les Mikesell wrote:
Tim wrote:
Remember, the object of this is to set the directory owner/modes so that the user can still create/remove his own files but can't remove/replace certain files that you will chown to root.
I am curious whether a user can cause system problems by modifying their own files?
Generally not, but they can get in a state where their own login does not work. I think this thread started in regard to someone other than the real user getting access and damaging some files.
Thanks, Les, I forgot to mention in the information that I sent that the changes to the user account would only affect that user. (unless of course that user is root, or a super user in the wrong account.)
Regards, Les H
On Sat, 2007-02-10 at 17:14 +1030, Tim wrote:
On Fri, 2007-02-09 at 09:44 -0600, Les Mikesell wrote:
Remember, the object of this is to set the directory owner/modes so that the user can still create/remove his own files but can't remove/replace certain files that you will chown to root.
I am curious whether a user can cause system problems by modifying their own files?
Yes, they can. There are many many files in the user account that either begin with "." or reside in a directory that begins with "." that the user owns and can modify, which are in fact modified by the controls for the various applications, so write capability is required for customization. If you go to a users directory and do the command % ls -al You will see a number of files and directories that begin with "." in each of these there are controls for the applications behavior from ".login" to ".bashrc" or ".kashrc" to various ".ini" files or ".dat" files that are used to setup and initialize applications, or in the case of the browser to select plugins to decode some forms of web data, such as JAVA or Jscript, movie formats, still photograph formats, downloads, etc. etc.
When I maintained Unix systems, I would always have a generic user account that I could verify settings in, so that I could take a user back to basics to get them going again when things got messed up in their accounts or to check that the system had not in some way become corrupted (we did development, so lots of things could happen).
Regards, Les H
Tim:
I am curious whether a user can cause system problems by modifying their own files?
Les:
Yes, they can. There are many many files in the user account that either begin with "." or reside in a directory that begins with "." that the user owns and can modify, which are in fact modified by the controls for the various applications, so write capability is required for customization. If you go to a users directory and do the command % ls -al
You will see a number of files and directories that begin with "." in each of these there are controls for the applications behavior from ".login" to ".bashrc" or ".kashrc" to various ".ini" files or ".dat" files that are used to setup and initialize applications, or in the case of the browser to select plugins to decode some forms of web data, such as JAVA or Jscript, movie formats, still photograph formats, downloads, etc. etc.
That much I know. They can affect how *they* use their account, but can they affect the "system"? i.e. What the computer does in their absence, and how other users use it?
Sure, I can stuff up my .bash* files, and make it impossible for me to use my account properly. But the next person to log on isn't using my account, and isn't affected by my mangled .bash* files. The question is can I do something to my personal files that isn't restricted to my own use of a system?
On Thursday 08 February 2007 09:29, edwardspl@ita.org.mo wrote:
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
You can use the symbolic form literally. I think it's easier to understand. Let the computer do the binary/octal math. g+rwx means add the read, write, and execute bits for the group.
But I want to know what no of g+rwx...
The + means it is added to the bits already permitted. Look at them as groups of 3 bits in binary and take the octal value.
user group other rwx rwx rwx
You'll start with a home dir having rwx --- --- so that's 111 000 000 binary or 700 octal. Add the group rwx and you get 111 111 000 or 770 octal
So, g+rwx = 770, right ?
chmod +t ( What number of +t ) /home/edward
That's one more bit to the left, 1 000 000 000 binary, so 1000 octal. Add that to what you have.
Same here, you can type it that way and it means add the "sticky" bit.
Also want to know...
Altogether, the octal value for the mode ends up at 1770. But, as I said before the computer does a better job of thinking in octal.
So, +t = 1770, right ?
Edward.
When I first started learning how to write the permissions setting RWX I could not figure out how to do it using the letters. I found it very easy to understand doing it with the numbers. I type it like this chmod 777 <file> to get the rwxrwxrwx and if I want to change it to rwxr-xr-x I just type chmod 755 <file> and if I want rwx------ I type chmod 700 <file>. I am sure I can figure out how to write it with the letters now but I think it is much easier to use the numbers.
linuxmaillists@charter.net wrote:
On Thursday 08 February 2007 09:29, edwardspl@ita.org.mo wrote:
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward
You can use the symbolic form literally. I think it's easier to understand. Let the computer do the binary/octal math. g+rwx means add the read, write, and execute bits for the group.
But I want to know what no of g+rwx...
The + means it is added to the bits already permitted. Look at them as groups of 3 bits in binary and take the octal value.
user group other rwx rwx rwx
You'll start with a home dir having rwx --- --- so that's 111 000 000 binary or 700 octal. Add the group rwx and you get 111 111 000 or 770 octal
So, g+rwx = 770, right ?
chmod +t ( What number of +t ) /home/edward
That's one more bit to the left, 1 000 000 000 binary, so 1000 octal. Add that to what you have.
Same here, you can type it that way and it means add the "sticky" bit.
Also want to know...
Altogether, the octal value for the mode ends up at 1770. But, as I said before the computer does a better job of thinking in octal.
So, +t = 1770, right ?
Edward.
When I first started learning how to write the permissions setting RWX I could not figure out how to do it using the letters. I found it very easy to understand doing it with the numbers. I type it like this chmod 777 <file> to get the rwxrwxrwx and if I want to change it to rwxr-xr-x I just type chmod 755 <file> and if I want rwx------ I type chmod 700 <file>. I am sure I can figure out how to write it with the letters now but I think it is much easier to use the numbers.
Hello,
So...Do you know the following ( convert to the no format) ?
1, chmod g+rwx ( What number of g+rwx, eg : ?77 ) /home/edward 2, chmod +t ( What number of +t ) /home/edward
Edward.
On Thu, 2007-02-08 at 13:36 +0800, edwardspl@ita.org.mo wrote:
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
Tom Spec wrote:
What do you mean by "solution"? Do you want to stop people from logging in when they have the correct password?
You should make your passwords strong enough so that people cannot (easily) guess/hack them. Don't allow people to log in as root remotely. You can limit where people can log in from by using iptables.
Tom
If there is ssh-telnet service for user... Then is there a solution to fix the problem of hack ( although someone who know the user's password, but they can't modify / delete any profile files, so the user who can login to the server nect time again ) ? eg : limit user profile ( user account ) ? if so, how to do this ?
Edward.
I think the real solution is to teach your user that it is important not to let others know his password if he hasn't figured that out himself yet. And if others do need this access they should have their own accounts instead of being able to pretend to be someone else.
Hello,
But I think the user account ( profile files ) is also problem, so, I want to know how limit the related files ( including the dot file ) !
Edward.
The only thing that the system "knows" about the user is the username and password. If those are correct, as far as the computer is concerned the person driving the keys is supposed to have that level of access. There are other security methods that could be installed and used, such as key cards, randomizer tokens to choose periodic random passwords in sync with a randomizer server, or personal ID things such as fingerprint scanners or even facial recognition o name a few. But these technologies are still quite new and the cost of implementation such scanners is quite high.
Regards, Les H
On Thursday 08 February 2007 11:36:21 Les wrote:
On Thu, 2007-02-08 at 13:36 +0800, edwardspl@ita.org.mo wrote:
Les Mikesell wrote:
edwardspl@ita.org.mo wrote:
Tom Spec wrote:
What do you mean by "solution"? Do you want to stop people from logging in when they have the correct password?
You should make your passwords strong enough so that people cannot (easily) guess/hack them. Don't allow people to log in as root remotely. You can limit where people can log in from by using iptables.
Tom
If there is ssh-telnet service for user... Then is there a solution to fix the problem of hack ( although someone who know the user's password, but they can't modify / delete any profile files, so the user who can login to the server nect time again ) ? eg : limit user profile ( user account ) ? if so, how to do this ?
Edward.
I think the real solution is to teach your user that it is important not to let others know his password if he hasn't figured that out himself yet. And if others do need this access they should have their own accounts instead of being able to pretend to be someone else.
Hello,
But I think the user account ( profile files ) is also problem, so, I want to know how limit the related files ( including the dot file ) !
Edward.
The only thing that the system "knows" about the user is the username and password. If those are correct, as far as the computer is concerned the person driving the keys is supposed to have that level of access. There are other security methods that could be installed and used, such as key cards, randomizer tokens to choose periodic random passwords in sync with a randomizer server, or personal ID things such as fingerprint scanners or even facial recognition o name a few. But these technologies are still quite new and the cost of implementation such scanners is quite high.
Regards, Les H
Don't know if someone has already talked about it or not during the whole thread. But...what if the user account which was hacked had some ssh-keys on it .ssh/ It might be stolen :-)
Just to keep this thread alive :-)
-
Dotan Cohen -
Edward S.P. Leong -
Howard Howell -
Les Mikesell -
linuxmaillists＠charter.net -
Manuel Arostegui Ramirez -
Tim -
Tom Spec