I want to disable USB access to root and enable it when it is required.  I need to restrict users to copy and paste anything using external drives.  Can anyone help me on this?
116837
I'm using Ubuntu 12.04 and I want to block usb storage on it. What is the correct way to do this?
6272
I've read  and am interested in this line:     You should never use normal sudo to start graphical applications as Root.   Why? What is the difference? Please provide a simple explanation, as I'm just a normal desktop user.
89927
We have several user accounts that we create for automated tasks that require fine-grained permissions, such as file transfer across systems, monitoring, etc.   How do we lock down these user accounts so that these "users" have no shell and are not able to login? We want to prevent the possibility that someone can SSH in as one of these user accounts.
15148
I would like to enable the root account on my Ubuntu installation.  I realize the security implications of this.
47816
Ubuntu disables root login for "security reasons". However it seems to me that it doesn't help with security at all.  If an intruder manages to get your login password for Ubuntu, then he also has the super-user password, since it's the same as the login password.  However if the root password is required, then just having the login won't help the intruder much - that's right isn't it?  So basically, what I want to know is: Why did Ubuntu choose to disable the root password? What are the security reasons?  Please don't answer according to what you "think" was the reason - I'm looking for an answer from official sources, or linked to them.
95249
Is there some permissions setup that would allow a user, say, john, to add a file to a directory d, but not be able to remove an existing file owned by another user, say, root?   My understanding is that this is not possible, since one needs execute permissions to add a file to the directory, but this also gives on the power to unlink any file in the directory.  (I'm using Mac OS 10.9, but this question presumably applies to all POSIX-ish systems.)
24514
In my  High school there are few computer having Ubuntu 14.04 installed and many students know the Root  password, how  can I block/disable  certain dangerous  commands like :- rm -rf / rm -rf * :(){:|:&amp;};: to avoid Data loss ?
57841
I want to give non-sudo access to a non-root user on my machine, there is a user dns-manager, his only role is to run all the BIND commands(rndc, dnssec-keygen) etc.   Now everytime he has to run a command, he types,  sudo rndc reload   Is there a way I can get rid of this sudo, but only on a particular set of commands(and only for dns-manager)?
21578
For some reason, I can run halt, poweroff, shutdown, and reboot as a regular user without root. How can I fix this? Is it something to do with user groups, or is it a seting somewhere?
99605
[root@notebook ~]# grep root /etc/sudoers root    ALL=(ALL)   ALL   Question: Why does the root user need sudo permissions? I've seen it on different UNIX OSes. Can someone please explain this?
92141
I am trying to use my ext4 USB drive but Ubuntu 13 is currently mounting it with write permission only for root so with my normal user I can't write to it, without sudo.   The first place I checked was dconf-editor which has the following options   automount automount-open autorun-never autorun-x-content-ignore autorun-x-content-open-folder autorun-x-content-start-app   and it seems to me there should be an option in there to control if I can write to the mounted USB drive, but no.   I also made sure my user is in the relevant groups: fuse and plugdev  I've searched most of the internet and can't find a solution to change the permissions given by the mount operation. There's literally nobody out there having this problem incredibly. A ton of people have issues because their drives mounts totally read-only, but not this way with only root write permission.  I can't see any way of controlling what happens. I looked at setting the mount options using gnome-disks but drew a blank.  It's not in fstab but it does appear in the mount list or /etc/mtab:  /dev/sdb1 /media/adam/WDPassport2T ext4 rw,nosuid,nodev,uhelper=udisks2 0 0   This is what appears in syslog if it helps:  kernel: [111522.196770] usb 2-1: USB disconnect, device number 6 kernel: [111525.384020] usb 2-1: new high-speed USB device number 7 using ehci-pci kernel: [111525.565220] usb 2-1: New USB device found, idVendor=1058, idProduct=0820 kernel: [111525.565225] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=5 kernel: [111525.565227] usb 2-1: Product: My Passport 0820 kernel: [111525.565229] usb 2-1: Manufacturer: Western Digital kernel: [111525.565231] usb 2-1: SerialNumber:  575832314141334A34383631 kernel: [111525.565729] usb-storage 2-1:1.0: USB Mass Storage device detected kernel: [111525.566203] scsi9 : usb-storage 2-1:1.0 mtp-probe: checking bus 2, device 7: "/sys/devices/pci0000:00/0000:00:1d.7/usb2/2-1" mtp-probe: bus: 2, device: 7 was not an MTP device kernel: [111526.564697] scsi 9:0:0:0: Direct-Access     WD       My Passport 0820 1007 PQ: 0 ANSI: 6 kernel: [111526.565063] scsi 9:0:0:1: Enclosure         WD       SES Device       1007 PQ: 0 ANSI: 6 kernel: [111526.568096] sd 9:0:0:0: Attached scsi generic sg2 type 0 kernel: [111526.568202] ses 9:0:0:1: Attached Enclosure device kernel: [111526.568263] ses 9:0:0:1: Attached scsi generic sg3 type 13 kernel: [111531.263108] sd 9:0:0:0: [sdb] 3906963456 512-byte logical blocks: (2.00 TB/1.81 TiB) kernel: [111531.265100] sd 9:0:0:0: [sdb] Write Protect is off kernel: [111531.265105] sd 9:0:0:0: [sdb] Mode Sense: 47 00 10 08 kernel: [111531.266473] sd 9:0:0:0: [sdb] No Caching mode page found kernel: [111531.266479] sd 9:0:0:0: [sdb] Assuming drive cache: write through kernel: [111531.272224] sd 9:0:0:0: [sdb] No Caching mode page found kernel: [111531.272230] sd 9:0:0:0: [sdb] Assuming drive cache: write through kernel: [111531.284885]  sdb: sdb1 kernel: [111531.288219] sd 9:0:0:0: [sdb] No Caching mode page found kernel: [111531.288223] sd 9:0:0:0: [sdb] Assuming drive cache: write through kernel: [111531.288227] sd 9:0:0:0: [sdb] Attached SCSI disk kernel: [111531.751588] EXT4-fs (sdb1): mounted filesystem with ordered data mode. Opts: (null) udisksd[3131]: Mounted /dev/sdb1 at /media/adam/WDPassport2T on behalf of uid 1000
89624
I've been reading . Apparently I would gain root access if I hold down enter (somewhere) for 70 seconds. I tried it on a password prompt but it gave me like 3 attempts and stopped. I tried it on a tty but it didn't work also. Am I not vulnerable or am I doing it wrong?
86842
I want to have a root privileges on some directories. How can I do this?
64140
I have customers who want to buy large amount of flash memories but he wants to copyright all files inside it.   The flash will contain files that will be delivered for his customers but they're not allowed to copy or delete any of the files the only allowed permission is to ready the files.   I searched and found many solutions but all have on function it WriteProtect the USB though I can't add files to Drive at all but I can delete or copy any file in the drive.   Is there any way to protect the flash memory so I can't copy data out of it?
804
When using sudo to allow edits to files, I regularly get 'permission denied'.  For example, my mouse is jittery and sluggish, so I want to disable polling:  sudo echo "options drm_kms_helper poll=N"&gt;/etc/modprobe.d/local.conf   I'm prompted for a password, and then get:  bash: /etc/modprobe.d/local.conf: Permission denied   So I tried to do a temporary change to disable polling by using:  sudo echo N&gt; /sys/module/drm_kms_helper/parameters/poll   Yet again the system responded with:  bash: /sys/module/drm_kms_helper/parameters/poll: Permission denied   Any ideas?
93069
This might be a very naive question, but I wanted to know how I could give multiple users access to a single computer without making them root users. How would I give them limitted sudo access such that they could still issue commands like  sudo apt-get install epstopdf   I imagine this could be an incredibly stupid question as once root user access is given, they could do whatever they want. Therefore, is there any way around this? I am open to suggestions
73682
Why does Linux require that a user be root/using sudo/specifically authorized per mount in order to mount something? It seems like the decision as to whether to allow a user to mount something should be based on their access rights to the source volume/network share and to the mount point. A couple of uses for non-root mounting are mounting file-system images to a user owned direction and mounting a network share to a user owned directory. It seems like if the user has control over both sides of the mount equation everything should be cool.  Clarification of access restriction:  I feel I should be able to mount anything that the user otherwise would have access to to a mount-point that the user is the owner of.  For instance, on my computer /dev/sda1 is owned by user root and group disk with permissions brw-rw----. Therefore non-root users can't mess with /dev/sda1 and clearly mount shouldn't allow them to mount it. However if the user owns /home/my_user/my_imagefile.img and mount point /home/my_user/my_image/ why shouldn't they be able to mount that image file on that mount point with:  mount /home/my_user/my_imagefile.img /home/my_user/my_image/ -o loop   As kormac pointed out there is a suid problem. So some restrictions would have to be added to prevent suid from being a problem as well as potentially some other issues. Perhaps one way to do this would be to make the OS treat all files as belonging to the user that did the mounting. However for simple read/write/execute, I don't see why this would be a problem.  Use case:  I have an account in a lab where my home space is restricted to 8GB. This is tiny and very very annoying. I would like to mount an nfs volume from my personal server to essentially increase the amount of room that I have. However, because Linux does not allow such things I'm stuck with scp'ing files back and forth to stay under the 8GB limit.