2

I have just added a new user in Debian but i am just wondering how i can restrict their access to other folders, really i just want them to stay in their own directory /home/username

0

5 Answers 5

2

Unless you add someone to some other groups, the only place they will be able to create files is in /home/username/ and /tmp/.

Any user who wants privacy can chmod their home directory 750 or 700 instead of the default 755, but that is for each user to decide.

IIRC the root home directory permissions are enough to keep everything recursively inside that directory private.

1

there are many ways to do this, but if you really want to restrict them to their own home dir then you probably want a restricted shell solution.

0
1

This is the default behaviour for Linux systems. You should be fine just leaving things how they are, but you may want to test and see if the restrictions are really in place by logging in as the new user and trying to change files outside the home directory.

I would also like to say that they will be able to read configuration files in the /etc directory as well as other system files, but will not be able to see/modify the contents of other people's home directory. Note that sensitive system files (such as private keys for SSH) are only readable by root.

4
  • as it is now i think the user is allowed to browse all folders etc, just want it so they can't leave their home directory and interfer with other system/users files...
    – David
    Feb 25, 2010 at 19:16
  • 1
    They should not be able to interfere with other users at all, see my edit. The philosophy with Linux is that no users can affect the settings for other users or read their files. There is really no reason to not let them see the system files, as all the sensitive ones are only readable by the superuser. If you have a specific file(s) or folder(s) that you don't want any of the users to see, you can chmod it so that it is only readable by root, like the other protected files.
    – marcusw
    Feb 25, 2010 at 19:22
  • @David: understand that a user must have access to other parts of the filesystem to do things like run programs. they don't need to have much access -- read, and execute, but not write -- but they do need access. unless you're going to provide a chroot jail environment with all the binaries they're allowed to run... Feb 25, 2010 at 19:35
  • Yes, that is the way I should have explained it. System files are REQUIRED for system operation, no exceptions. If you want to take the problem somewhere else with a chroot, that is fine too, but certainly not the solution I would use...
    – marcusw
    Feb 26, 2010 at 0:31
0

Edit /etc/passwd, and specify that they use a restricted shell, like rbash. They can then only execute commands from their PATH (which you can control), can't change the contents of PATH, and can't change directory.

0

Chroot is a possible solution, but a drastic one, since you lose also the access to all /bin and such directories. We had a system set up for the students that had each home a ~/bin subdir with the needed programs in it and a login with chroot to ~ of the student. That worked well but it needed some preparation. Try this if you want the person to have VERY little access with or without the restricted shell.

You must log in to answer this question.