Prevent a list of Users from executing a file


Enter Your Query:
Use '%' for wildcards and quotes for "exact phrases"


Top Level » System Level » File System

Prevent a list of Users from executing a fileLast Modified: Mar 9, 2016, 3:25 pm
There are many scenarios where you'd not want a User or Users to execute a specific file.
For example, wget or perl might be binaries that you'd not want Users to run.

In this example, we'll discuss how to use group permissions to prevent a group of Users from executing the file:

  1. First, we need to create a group that will be filled with Users.  Let's call this group :

    groupadd noperl


  2. Next, we'll assign this group to the perl binary, and set it's permissions such that no User in the noperl group can execute it:

    chgrp noperl /usr/bin/perl
    chmod 705 /usr/bin/perl

    where using the permissions, the 0 portion specifies that the group on this file cannot do anything on it (can't read it, can't write to it, and cannot execute it)

  3. Lastly, add any Users to this group who should not be allowed to execute perl:

    usermod -a -G noperl apache
    usermod -a -G noperl fred
    usermod -a -G noperl george

    where apache, fred, and george cannot run /usr/bin/perl.


This guide can be applied to other binaries as needed, but make sure that you don't block any Users which actually need to use the given binary.

  1. If you want to automate the adding of newly created Users to this group, create the file:

    /usr/local/directadmin/scripts/custom/user_create_post.sh

    and add the code

    #!/bin/sh
    /usr/sbin/usermod -a -G noperl $username 2>&1
    RET=$?
    exit $RET

    and chmod the script to 755.

© 2018 JBMC Software, Suite 173  3-11 Bellerose Drive, St Albert, AB  T8N 1P7  Canada.  Mon-Fri 9AM-5PM MST