The best approach (one which I have not done until now) is to create user accounts for each individual user who will be using the shell and setting appropriate privileges to each user. The following describes how this can be achieved for a new user called tykus:
$sudo useradd tykusThis has created a user, but we now need to set a password for this user:
$sudo passwd tykus Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully $We are asked to enter a new UNIX password and to confirm it. We're not quite done just yet because this method does not automatically create the new user's home directory, although it does assume it will be located at /home/tykus (in this case). So our next step is to create that directory:
$sudo mkdir /home/tykusIf we run a list command ($ls -l), we are given information about the contents of the /home directory
$cd /home $ls -l total 8 drwxr-xr-x 16 pi pi 4096 Jul 6 10:11 pi drwxr-xr-x 2 root root 4096 Jul 6 11:29 tykus $The information provided tells use what is in the directory, who owns it and what permissions are associated with it, specifically each line tells us:
- Field 1: permission flags (10 of them!)
- Field 2: link count
- Field 3: owner of the file
- Field 4: associated group for the file
- Field 5: size in bytes
- Field 6-8: date of last modification
- Field 9: name of file
$touch /home/tykus/new_file touch: cannot touch `new_file': Permission denied $Whereas, if we try to execute a python script in the same directory (as pi), we can do that:
$python /home/tykus/hello.py Hello World! $We need to give the directory to its rightful owner:
$sudo chown tykus:tykus /home/tykusNote: if there were already contents in this directory (such as the python script above), we should include a -R option to recursively change permissions for all directories and files in the directory. For security reasons we will also change permissions so that only the owner can read, write and execute the home directory:
$sudo chmod 700 /home/tykusPreferred Shell If we check the /etc/passwd file, our new user is added to the end; included details are colon (:) separated as follows: Username:Password:User ID:Group ID:Comment:Home directory:Shell (more information here)
tykus:x:1002:1002::/home/tykus:/bin/shSo tykus will log in to the sh shell, whereas we prefer the Bourne shell (bash), so we can change /bin/sh to /bin/bash (or whatever shell is preferred) We can now login as tykus and keep all of our files private from other users!
