2

As the main admin of a server, I want to make it so that users can't see each others home folders. (so I chmod 750 the home folder which includes me, so I can see mine but can't see other people's).

I realise I can 'su' to change in to the users if I need to see in their folders, but I am presuming that root would be able to move in to that folder and see the contents, but obviously I can't 'sudo cd' or 'sudo ls'.

So I was thinking of having all users in a 'user group' which I could be a member of. Or is this a terrible idea? Should I just 'su' or is there a way around this that I can't think of?

I did search for solutions but as you can imagine 99.9% of the solutions you find are not talking about this specific scenario, more permissions in general.

So to summarise: I want to be able to see what's in user's folders without having to 'su', but leave other users unable to see in each other's folders.

  • Why can't you sudo ls if you're the admin of the system? – doneal24 Apr 8 '16 at 14:39
  • Apologies per below my problem was actually that I cant as a normal user get in to the folder to 'sudo ls'. It was poorly explained. :) – ablueman Apr 8 '16 at 14:49
  • oh damn im dumb, I could just sudo ls /home/userfolder Sorry complete linux noob >.< – ablueman Apr 8 '16 at 14:51
1

The only way to accomplish this without resorting to ACLs is, Permissions set to 750 and your username being a member of every other user's primary group. For instance, lets say you have these users:

me
user1
otheruser

/home will look something like this:

drwxr-x---  2 me        me         4096 Mar  3 12:14 me
drwxr-x--- 24 user1     user1      4096 Apr  8 05:33 user1
drwxr-x---  2 otheruser otheruser  4096 Feb 11 09:27 otheruser

and in your group file you will see these

me:x:500:
user1:x:501:
otheruser:x:502:

and you are going to add yourself to other users' primary groups and your group fill will look like this:

me:x:500:
user1:x:501:me
otheruser:x:502:me
  • Thanks, so in honesty 'su' is prob a better option until I learn some more. – ablueman Apr 8 '16 at 14:40
  • my sentiments exactly. I do not like co-mingling groups either. Also, sudo ls is a valid command that you can run, while sudo cd is NOT! – MelBurslan Apr 8 '16 at 14:43
  • yeah so the problem is I cant get in to the folder to 'sudo ls' actually not that 'sudo ls' is wrong. (Thanks for that). A more elegant solution is possibly to just 'sudo -s' for the duration of whatever I need to do I guess. – ablueman Apr 8 '16 at 14:47
  • oh damn im dumb, I could just sudo ls /home/userfolder – ablueman Apr 8 '16 at 14:51
0

I Wouldn't advice to become a member of all user groups, but have a look at extended ACLs instead.

Read about setfacl and getfacl on the web or the man pages and set default ACLs which allow you to enter the other home directories.

  • Thanks for the answer, i got that impression but had to give the answer to the other gent as he was really first. (Id have upvoted you as well but .. eh i dont even have 15 yet to do it :D). – ablueman Apr 8 '16 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.