Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

A few days ago I installed a new linux os. Today i realize /root has o+r (755) so EVERYONE is able to see my root sql password in /root/.my.cnf. I freaked out and simply changed /root to 750.

My /var/www folder is 2755 but all the folders in it are 2750 (so certain users can browse to the folder without being blind). What software, file permissions and other DEFAULT configuration should I change?

share|improve this question
5  
Please specify the distro you installed. None of the ones I've used set /root to world readable. –  Keith Feb 28 '11 at 5:58
2  
@Keith: Really? Ubuntu 8.04 and Debian 6 both have root as readable to others. –  acidzombie24 Feb 28 '11 at 8:38
1  
Well, I don't use those. ;-) –  Keith Feb 28 '11 at 10:02
1  
Always set the permission on files with passwords to 600 or 400. The loosest permission I would allow is 640 or 440 if users in a specific group need access. I have an ssl-certs group where this would apply. –  BillThor Feb 28 '11 at 21:58
2  
@Tshepang: /root has always been 755 on Debian and Ubuntu, as far as I remember. My unreliable memory goes back to potato, and I can verify this for machines where the first install was etch, lenny, warty, hardy or lucid. –  Gilles Feb 28 '11 at 22:38
show 7 more comments

1 Answer

perhaps you should do a scan of your system with a tool like tiger. Tiger will pick up lots of things like this, and is a great way to get lots of advice and suggestions about how to secure your system. Tiger can also be useful as a kind of Intrusion Detection System, too.

share|improve this answer
    
It didnt show me the 755 problem (i changed it to 755 for my second scan to see if it picks it up. it didnt) but i like tiger anyways so +1 –  acidzombie24 Mar 7 '11 at 22:46
    
hmm, well then I apologise! it will go crazy if root's ~/.ssh folder is world-readable, for example. If Debian ships with /root as 755, and tiger doesn't warn about it, I would take that as a decent indication that it's not an unreasonable setting to operate with. –  simon Mar 8 '11 at 1:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.