Recommended permissions for /home

Question

What is a recommended setup for /home permissions?

I know about user / group / other, about sgid flag and I know what User Private Groups are. I have read the comment about adduser no longer setting sgid on /home/<user> "because of bad side-effects". So apparently the original User Private Group setup is no longer "the way to go".

What I did not find was any hint as to what the recommended "way to go" is with regards to user permissions and groups in /home.

Use case: Family computer, four users, two parents, two kids, and I want to share certain files / directories and prohibit access of the kids to others. I know half a dozen ways to do this, but what is recommended (so I avoid roadblocks I haven't thought about yet)?

Answer 1

The umask that should be used in a system depends on the needs of that system, the users and the system administrator himself.

The most typical values, however, are 022 (everything created is world-readable), 077 (hardened, nothing shared by default) and what's considered a compromise between the two: 027 (group-readable).

You may still use a separate user-read/writable location for your users to collaborate, even if you chose a restrictive umask.

If you do end up changing the umasks for your system, do not forget to run commands like the following:

find /home/name -type d -exec chmod -v 0700 {} \;

find /home/name -type f -exec chmod -v 0600 {} \;

Keep in mind that these will -x all files in the user's home directory tree.