How to restrict what a user can install/download in their home directory?

Anthony Nash

2/26/23, 5:21 PM

I've had a search but I can't quite find a solution or explanation to this topic. I would appreciate your thoughts and suggestions and I appreciate in advance that this might cover several topics.

I've recently started managing a high-performance Ubuntu machine (x2 GPUs, x2 socket Intel Xeons, 128GB RAM, etc). Users can SSH into a terminal and submit persistent processes via tmux (I'm not quite tech-savvy to tackle SLURM yet). This is my Ubuntu system:

Distributor ID: Ubuntu
Description:    Ubuntu 20.04.3 LTS
Release:    20.04
Codename:   focal

I currently have two users plus one admin:

/home/user1
/home/user2
/home/admin

Users do not have root privileges.

I would like Users to be able to set up their own R and Python environments. This will involve downloading R libraries and Python modules as and when they need them. As a daily R and Python user myself, I know that pulling down libraries and modules can be frequent and often unplanned so it's no good if it requires root access privileges on a frequent basis.

I would like a user to be able to:

-have access to Conda to create their own Conda environments so one User's setup does not impact the setup of another User. -be able to download and install R and Python packages into this environment - some packages, by their very nature, will compile using a C++ compiler. -prohibit installing anything else that is neither R nor Python-related.

Edit #1 I thought I'd provide an example of what I'm trying to achieve as I'm facing a lot of new tech and software and I'm at risk of losing focus.

A user connects to the machine using SSH and by default, they land in their /home/user directory. They begin working and find that they need Deseq2. The host distributors, Bioconductor, of Deseq2 make the package available via the following R code:

BiocManager::install("DESeq2")

The user needs to be in an environment where they can download and install DESeq2 then have it made available when they execute an R script from the Ubuntu terminal.

0 + 0

ssh

permissions

user-space

users

francois P

2/26/23, 5:27 PM

If users have to be able to have a full environment, there are few solutions, dedicated virtual machines, containers, chrooted environments etc... the risk is always the same, the user can break his environment. you can limit risks with hot-backups, & whitelists of source they can download from. This is to be thinked about too I think.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to restrict what a user can install/download in their home directory?

TH: จะจำกัดสิ่งที่ผู้ใช้สามารถติดตั้ง/ดาวน์โหลดในโฮมไดเร็กตอรี่ได้อย่างไร?

RO: Cum să restricționezi ceea ce un utilizator poate instala/descărca în directorul său principal?

RU: Как ограничить то, что пользователь может устанавливать/загружать в своем домашнем каталоге?

VI: Làm cách nào để hạn chế những gì người dùng có thể cài đặt/tải xuống trong thư mục chính của họ?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.