Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm working with a fresh install of Ubuntu 12.04 and I've just added a new user:

useradd -m testuser

I thought that the -m flag to create a home directory for users was pretty standard, but now that I've taken a closer look I'm a little confused:

By default the new directory that was just created shows up as:

drwxr-xr-x  4 testuser testuser 4.0K May 20 20:24 testuser

With the g+r and o+r permissions that means every other user on the system can not only cd to that user's home directory, but also see what is stored there.

When reading over some documentation for suPHP it recommends setting the permissions as 711 or drwx--x--x which is how it would make the most sense to me.

I noticed that I can change the permissions on the files inside /etc/skel and they are set correctly when creating new users with useradd -m but changing the permissions on the /etc/skel directory itself does not seem to have any effect on the new directories that are created for users in /home/

  • So - what type of permissions should a user's home directory and files have - and why?

  • If I wanted permissions to be different for useradd -m - like the 711 / drwx--x--x as I saw mentioned, how is one to do that? Must you create the user and then run chmod ?

share|improve this question
1  
leave a reason if you downvote –  cwd May 21 '13 at 3:31
1  
Have you looked at the man page of useradd? If you are on Ubuntu and want to use the commandline you should be using adduser. (BTW I did not downvote, but not finding the -K option yourself in the help/man page could indicate little research for others as you don't seem to be a complete Unix newbie) –  Anthon May 21 '13 at 3:37
    
@Anthon - yup. I missed the -K part in man - but I did look over it before asking (not well enough). However the man page still does not explain why it says If not specified, the mask will be initialized to 022. Also, it does not seem that adduser provides any other benefit besides an interactive prompt based system - it, too, creates the home directories by default as 755. –  cwd May 21 '13 at 3:49
    
adduser (its deluser counterpart) does things like deleting a users 'private' group which I don't think adduser does. It also makes it more easy to make a normal or system user with the uid in the right number range. I recommend you look at what can be specified for adduser in /etc/adduser.conf. –  Anthon May 21 '13 at 3:54

4 Answers 4

up vote 1 down vote accepted

To make the creation of the home directory behave differently do

useradd -m -K UMASK=0066 testuser

Giving other no access at all should be safe.

share|improve this answer
    
Interesting. So without that I guess it just is using the default umask set in the shell session ? –  cwd May 21 '13 at 2:58
    
@cwd: that is correct –  tink May 21 '13 at 3:00
    
@cwd Regarding the public_html thing you asked about in Ignacio's response: I'd make the owning group something that the apache user is a member of, and still get away w/o access for other –  tink May 21 '13 at 3:03
    
That sounds good to me. I will give it a shot. Thank you. –  cwd May 21 '13 at 3:37
1  
Shouldn't that umask be 0077 instead of 0066? –  Michael Kjörling Sep 30 '13 at 11:45

You should set DIR_MODE in /etc/adduser.conf and use the adduser command as recommended in the man page for useradd on your system:

adduser testuser

If you do not want to make changes to the original /etc/adduser.conf (or need different setups) you can make changes in a copy and use adduser --conf <yourconf>

share|improve this answer
    
Thx - this helps with the second part of the question. –  cwd May 21 '13 at 3:51

I've had no problems setting home directories as 0700 as a base, and then opening them up more little by little as required.

share|improve this answer
1  
Don't they need to be at least 711 if they contain something like a public_html folder, or if one of the subdirectories is a shared / group folder? Also, can you set them as your 700 by default somehow with the useradd -m command ? Also - why would Ubuntu even think it is OK to default to 755? –  cwd May 21 '13 at 2:57
1  
That would be part of the "as required". On my (Fedora) system the umask can be set in /etc/login.defs; Ubuntu must have something similar. –  Ignacio Vazquez-Abrams May 21 '13 at 2:58

Since you are posting this in security I will take a bait. This is how is done in by default in OpenBSD

drwxr-xr-x  5 predrag  predrag  512 May 20 23:00 predrag

My account has been created on the boot. You see that by default a separate group is created and I am logged in as a member of that group. That first account is by default member of the wheel group but not for example member of operator group which means that I could not shutdown the computer.

Note that by default new users on OpenBSD are added with adduser interactive Perl script which also creates the home directory with correct permission and many other things.

This is what RedHat does by default

drwx------. 48 predrag     predrag  4096 May 20 17:51 predrag

I am System Admin on that computer and that is regular account created by default for root user. RedHat doesn't have a custom script but some values of useradd are pre-populated with default values.

share|improve this answer

protected by Community Sep 30 '13 at 18:39

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.