4

Running Fedora 20 on a file server and ran into this strange issue, not sure what I'm doing wrong. The account I made while installing the OS works fine, but every other account I made has this problem.

When trying to login with su - USERNAME I get the following error:

su: warning: cannot change directory to /home/USERNAME: Permission denied
-bash: /home/USERNAME/.bash_profile: Permission denied

And from there bash just hangs in the terminal and I have to close it. If I try to login from the login screen, I get the same error popped up in a message box and after a short time I'm kicked back to the login screen.

If I ls -l any of the home directories, aside from the one I made at install, they contain 0 files. The permissions on the home directories are all set to 700 with the owner and group set to each users username and group.

I've also tried making a new user in the GUI and then switching to that user, but I get the same error.

Users need to be able to login through Samba to access file shares. Even though the login is successful, they have no permissions and get access denied.

Any ideas?

ls -ld / shows 755 root root for permissions ls -ld /home shows 700 acase acase for permissions. This is the user I made when installing the OS and the only one that works, is this the issue?

As for SELinux, I have not yet tried disabling it. I'm new to SELinux but when I cat the audit log and grep for 'acct="USERNAME"' of one of the new accounts, I only see 4 messages and their status is SUCESS. I'll try disabling it and see if it changes anything.

  • What are the permissions of / and /home ? – Mark Plotnick Nov 6 '14 at 16:10
  • Have you tried with SELinux disabled? – garethTheRed Nov 6 '14 at 16:10
  • Just out of curiosity, why in the world are you running sudo su - user instead of sudo -u user or su - user? – terdon Nov 6 '14 at 16:34
  • The Default Permissions for Users should be either 755, or 644, the /root folder should be 700. Setting /home/user to 700 ensures that users can only see their directory and no other users directory, which is what your describing,. Modifying the permissions to 755 will allow all users to read and write to eachother and 644 will allow read/execute IIRC... I hate octal permissions :) – eyoung100 Nov 6 '14 at 16:45
  • 1
    If you set /home to 700, users won't be able to access anything in it. If you want them to be able to access their home directories, but not list other home directories, it should be 711. – Barmar Nov 6 '14 at 16:49
3

Set the permissions on /home to 711, not 700. Execute permission is required to access anything within a directory by name, so all users need execute permission on / and /home to access /home/theirname. Omitting read permission will prevent them from listing all the other subdirectories of /home.

Permissions on the home directories themselves can be 700. This way, even if someone guesses another user's name, they won't be able to access that user's directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.