Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What is a recommended setup for /home permissions?

I know about user / group / other, about sgid flag and I know what User Private Groups are. I have read the comment about adduser no longer setting sgid on /home/<user> "because of bad side-effects". So apparently the original User Private Group setup is no longer "the way to go".

What I did not find was any hint as to what the recommended "way to go" is with regards to user permissions and groups in /home.

Use case: Family computer, four users, two parents, two kids, and I want to share certain files / directories and prohibit access of the kids to others. I know half a dozen ways to do this, but what is recommended (so I avoid roadblocks I haven't thought about yet)?

share|improve this question
    
Recommended for what? A system with trustworthy users? Or a system bursting with vandals and thieves? –  wallyk Oct 15 '12 at 5:15
    
@wallyk: Recommended for handling user / group permissions consistently and easily. I don't really want to get into ACLs. There was the "original" setup - <user>, group "users", other - and User Private Groups - <user>, <user>, others with sgid set. Apparently, they are both no longer "en vogue". So, is there some guideline on how to handle things, or is it all "ad hoc" now? –  DevSolar Oct 15 '12 at 5:42

1 Answer 1

The umask that should be used in a system depends on the needs of that system, the users and the system administrator himself.

The most typical values, however, are 022 (everything created is world-readable), 077 (hardened, nothing shared by default) and what's considered a compromise between the two: 027 (group-readable).

You may still use a separate user-read/writable location for your users to collaborate, even if you chose a restrictive umask.

If you do end up changing the umasks for your system, do not forget to run commands like the following:

find /home/name -type d -exec chmod -v 0700 {} \;

find /home/name -type f -exec chmod -v 0600 {} \;

Keep in mind that these will -x all files in the user's home directory tree.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.