up vote 1 down vote favorite
share [g+] share [fb]

I'm setting up a Linux machine thet'll be shared by several users, some of whom will be admins. Is there a way to restrict access to a user's home folder (encrypt or block completely) for other regular/admin users?

link|improve this question
73% accept rate
feedback

3 Answers

up vote 2 down vote accepted

Deny permissions take precedence over allow permissions.

Beyond that, several users shouldn't have administrative accounts. Give them the ability to escalate their privileges as necessary, but default access for everyone should be the same.

EDIT: What I mean by this is run chmod 700 /home/username on it.

Second edit due to very astute catch by @whitequark

link|improve this answer
so chmod -R go-r /home/someuser should do it? – sa125 Aug 17 '10 at 5:51
I'm more of a chmod 700 /home/someuser guy myself. – JBirch Aug 17 '10 at 6:32
@sa125: Be careful with the -R: It will also change permissions for all files. Also, don't forget the -x flag. If that is set, other users can still cd into the directory (even though they can't list it). – Aaron Digulla Aug 17 '10 at 7:14
2  
Don't do that! By doing chmod -R 700, you'll make all files in your home directory executable. At least it will cause problems with opening them in file managers. – whitequark Aug 17 '10 at 7:24
thanks everyone - I ended up using chmod -R go-rwx /home/someuser, then manually added permissions to folders that users will want to share (Music, Shared, Documents). – sa125 Aug 17 '10 at 7:46
show 1 more comment
feedback
up vote 2 down vote

The correct way to protect all directories in a home directory is:

find $HOME -type d -exec chmod go-rwx "{}" \;

That will remove permissions to run ls ('r'), to create files ('w') and to cd into a directory (x) for the other members of the user's group and everyone else.

link|improve this answer
feedback
up vote 1 down vote

The user's home folder is blocked by default on any linux system. So you won't have to worry about that.

link|improve this answer
Blocked so that "admin" users can't see? – Neal Aug 17 '10 at 5:59
root can do anything by default. But you can install a secured version of Linux (like SELinux) where you can restrict root, too. – Aaron Digulla Aug 17 '10 at 7:17
@Aaron: and who would have access to SELinux policy? That's all about the human factor. – whitequark Aug 17 '10 at 7:25
@whitequark: The human factor in this case is that the data is more than a cd away. – Aaron Digulla Aug 17 '10 at 8:06
@Aaron: Did we talked about restricting root? When people go sudo chmod-ing, the data is already farther than that. – whitequark Aug 17 '10 at 8:42
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.