up vote 1 down vote favorite
1
share [g+] share [fb]

I have just added a new user in Debian but i am just wondering how i can restrict their access to other folders, really i just want them to stay in their own directory /home/username

link|improve this question
@David. Please associate your accounts which should allow you to take ownership of this question. – Diago Feb 25 '10 at 21:55
(@Diago, thanks for the merge. @David, see stackoverflow.com/users/281510?tab=accounts#tab-top) – Arjan Feb 25 '10 at 22:01
feedback

migrated from stackoverflow.com Feb 25 '10 at 19:14

This question came from our site for professional and enthusiast programmers.

5 Answers

up vote 2 down vote

Unless you add someone to some other groups, the only place they will be able to create files is in /home/username/ and /tmp/.

Any user who wants privacy can chmod their home directory 750 or 700 instead of the default 755, but that is for each user to decide.

IIRC the root home directory permissions are enough to keep everything recursively inside that directory private.

link|improve this answer
feedback
up vote 1 down vote

This is the default behaviour for Linux systems. You should be fine just leaving things how they are, but you may want to test and see if the restrictions are really in place by logging in as the new user and trying to change files outside the home directory.

I would also like to say that they will be able to read configuration files in the /etc directory as well as other system files, but will not be able to see/modify the contents of other people's home directory. Note that sensitive system files (such as private keys for SSH) are only readable by root.

link|improve this answer
as it is now i think the user is allowed to browse all folders etc, just want it so they can't leave their home directory and interfer with other system/users files... – David Feb 25 '10 at 19:16
1  
They should not be able to interfere with other users at all, see my edit. The philosophy with Linux is that no users can affect the settings for other users or read their files. There is really no reason to not let them see the system files, as all the sensitive ones are only readable by the superuser. If you have a specific file(s) or folder(s) that you don't want any of the users to see, you can chmod it so that it is only readable by root, like the other protected files. – marcusw Feb 25 '10 at 19:22
@David: understand that a user must have access to other parts of the filesystem to do things like run programs. they don't need to have much access -- read, and execute, but not write -- but they do need access. unless you're going to provide a chroot jail environment with all the binaries they're allowed to run... – quack quixote Feb 25 '10 at 19:35
Yes, that is the way I should have explained it. System files are REQUIRED for system operation, no exceptions. If you want to take the problem somewhere else with a chroot, that is fine too, but certainly not the solution I would use... – marcusw Feb 26 '10 at 0:31
feedback
up vote 0 down vote

there are many ways to do this, but if you really want to restrict them to their own home dir then you probably want a restricted shell solution.

link|improve this answer
feedback
up vote 0 down vote

Edit /etc/passwd, and specify that they use a restricted shell, like rbash. They can then only execute commands from their PATH (which you can control), can't change the contents of PATH, and can't change directory.

link|improve this answer
feedback
up vote 0 down vote

Chroot is a possible solution, but a drastic one, since you lose also the access to all /bin and such directories. We had a system set up for the students that had each home a ~/bin subdir with the needed programs in it and a login with chroot to ~ of the student. That worked well but it needed some preparation. Try this if you want the person to have VERY little access with or without the restricted shell.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard