4

I just created new user account, but the new user is able to access all the directories structure (including other's home directories). I'd like to limit the user to access ONLY his home directory (and nothing "above"). How do I do this?

2 Answers 2

3

Set the modes on all home directories to 0700.

Optionally, set the default umask to 077. In Ubuntu, edit the "umask 022" line in /etc/profile. Optionally, update PAM configuration in /etc/pam.d/common-session (pam_umask.so umask=077 usergroups).

Optionally, chmod /etc/skel and update /etc/adduser.conf (line "DIR_MODE=0755") to 0700.


You cannot restrict a user to "home directory and nothing \"above\"" without a lot of headache, and it does not make sense either (for me, at least):

  • To execute any program, the user must have 'read' access to it.
  • To use shared libraries, a program must have 'read' access to them.
  • To read the system-wide configuration files and resources, 'read' access is needed too.

It is write access you should be afraid of, and the default permissions already prevent writing anywhere except a few locations.

4
  • ok, what are these "few locations"?! It's quite important for me.
    – migajek
    Feb 20, 2011 at 21:05
  • @vic: find / -xdev -type d -a \( -path "$HOME" -prune \) -o \( -writable -a -executable \) -ls 2>/dev/null # this will list directories that you have write access to. Feb 20, 2011 at 21:17
  • 1
    The few locations are files where passwords are stored in clear text, or other sensible data. For example, if you are using vpn and the pptp-linux packet. The password will be stored in /etc/ppp/pap-secrets or /etc/ppp/chap-secrets or in an folder above. Wich places this are depends really on your setup and your software. But in general the default rights for all files are set appropriate.
    – Darokthar
    Feb 20, 2011 at 21:36
  • as i said: "But in general the default rights for all files are set appropriate.".
    – Darokthar
    Feb 20, 2011 at 22:14
1

This thread is little bit old but anyways you can restrict the users (very restrictive) to home directory by changing the bash shell to rbash if you really want it. By this way the user can't be able to use cd command. Or change the home directory owner as mentioned above. But remember that the user can execute bash so perform restrictive settings...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .