up vote 4 down vote favorite
2

I just created new user account, but the new user is able to access all the directories structure (including other's home directories). I'd like to limit the user to access ONLY his home directory (and nothing "above"). How do I do this?

share|improve this question
up vote 3 down vote

Set the modes on all home directories to 0700.

Optionally, set the default umask to 077. In Ubuntu, edit the "umask 022" line in /etc/profile. Optionally, update PAM configuration in /etc/pam.d/common-session (pam_umask.so umask=077 usergroups).

Optionally, chmod /etc/skel and update /etc/adduser.conf (line "DIR_MODE=0755") to 0700.

You cannot restrict a user to "home directory and nothing \"above\"" without a lot of headache, and it does not make sense either (for me, at least):

  • To execute any program, the user must have 'read' access to it.
  • To use shared libraries, a program must have 'read' access to them.
  • To read the system-wide configuration files and resources, 'read' access is needed too.

It is write access you should be afraid of, and the default permissions already prevent writing anywhere except a few locations.

share|improve this answer
    
ok, what are these "few locations"?! It's quite important for me. – migajek Feb 20 '11 at 21:05
    
@vic: find / -xdev -type d -a \( -path "$HOME" -prune \) -o \( -writable -a -executable \) -ls 2>/dev/null # this will list directories that you have write access to. – grawity Feb 20 '11 at 21:17
1  
The few locations are files where passwords are stored in clear text, or other sensible data. For example, if you are using vpn and the pptp-linux packet. The password will be stored in /etc/ppp/pap-secrets or /etc/ppp/chap-secrets or in an folder above. Wich places this are depends really on your setup and your software. But in general the default rights for all files are set appropriate. – Darokthar Feb 20 '11 at 21:36
    
as i said: "But in general the default rights for all files are set appropriate.". – Darokthar Feb 20 '11 at 22:14
up vote 1 down vote

This thread is little bit old but anyways you can restrict the users (very restrictive) to home directory by changing the bash shell to rbash if you really want it. By this way the user can't be able to use cd command. Or change the home directory owner as mentioned above. But remember that the user can execute bash so perform restrictive settings...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.