I just created new user account, but the new user is able to access all the directories structure (including other's home directories). I'd like to limit the user to access ONLY his home directory (and nothing "above"). How do I do this?
Set the modes on all home directories to 0700.
Optionally, set the default umask to
077. In Ubuntu, edit the "
umask 022" line in
/etc/profile. Optionally, update PAM configuration in
pam_umask.so umask=077 usergroups).
/etc/skel and update
/etc/adduser.conf (line "
DIR_MODE=0755") to 0700.
You cannot restrict a user to "home directory and nothing \"above\"" without a lot of headache, and it does not make sense either (for me, at least):
- To execute any program, the user must have 'read' access to it.
- To use shared libraries, a program must have 'read' access to them.
- To read the system-wide configuration files and resources, 'read' access is needed too.
It is write access you should be afraid of, and the default permissions already prevent writing anywhere except a few locations.
This thread is little bit old but anyways you can restrict the users (very restrictive) to home directory by changing the bash shell to rbash if you really want it. By this way the user can't be able to use cd command. Or change the home directory owner as mentioned above. But remember that the user can execute bash so perform restrictive settings...