Directory Trees on the IFS (Security)

Jeffrey,
>        I have a quick question.  Has anyone worked with the directory
tree
>on the IFS enough to
>have found a way to keep users from walking up the tree to the root.
Home
>Directory is not enough to
>keep users from walking back up..
>
>        The problem is I have a tree that branches 2 levels down, and user
1
>should only have access to branch 1, and User 2 should only have access to
>Branch 2 and neither user should be in common portion of the tree for any
>reason, but they need to be able to FTP data into there respective
trees....

Use authorities on the directories to prevent users from going where you do
not want them to go. For example, each user should have *X (search)
authority to each directory in the path to their home directory. They
should also have *RWX authority to their own home directory and *EXCLUDE
authority to everyone else's home directory. The *PUBLIC should have
*EXCLUDE authority to all home directories. This will allow your users to
walk up the tree to the root but prevent then from getting into anyone
else's home directory.

One other think to consider. The public should have *RWX authority to /tmp
but that is probably one of the only directories to which the public should
have write authority. You may want to monitor (audit) the use of all
directories where the public has *RWX authority. You may want to review the
authorities on all other directories in root.

Ed Fishel,
edfishel@US.IBM.COM


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---