2

As the main admin of a server, I want to make it so that users can't see each others home folders. (so I chmod 750 the home folder which includes me, so I can see mine but can't see other people's).

I realise I can 'su' to change in to the users if I need to see in their folders, but I am presuming that root would be able to move in to that folder and see the contents, but obviously I can't 'sudo cd' or 'sudo ls'.

So I was thinking of having all users in a 'user group' which I could be a member of. Or is this a terrible idea? Should I just 'su' or is there a way around this that I can't think of?

I did search for solutions but as you can imagine 99.9% of the solutions you find are not talking about this specific scenario, more permissions in general.

So to summarise: I want to be able to see what's in user's folders without having to 'su', but leave other users unable to see in each other's folders.

3
  • Why can't you sudo ls if you're the admin of the system?
    – doneal24
    Apr 8, 2016 at 14:39
  • Apologies per below my problem was actually that I cant as a normal user get in to the folder to 'sudo ls'. It was poorly explained. :) Apr 8, 2016 at 14:49
  • oh damn im dumb, I could just sudo ls /home/userfolder Sorry complete linux noob >.< Apr 8, 2016 at 14:51

2 Answers 2

1

The only way to accomplish this without resorting to ACLs is, Permissions set to 750 and your username being a member of every other user's primary group. For instance, lets say you have these users:

me
user1
otheruser

/home will look something like this:

drwxr-x---  2 me        me         4096 Mar  3 12:14 me
drwxr-x--- 24 user1     user1      4096 Apr  8 05:33 user1
drwxr-x---  2 otheruser otheruser  4096 Feb 11 09:27 otheruser

and in your group file you will see these

me:x:500:
user1:x:501:
otheruser:x:502:

and you are going to add yourself to other users' primary groups and your group fill will look like this:

me:x:500:
user1:x:501:me
otheruser:x:502:me
4
  • Thanks, so in honesty 'su' is prob a better option until I learn some more. Apr 8, 2016 at 14:40
  • my sentiments exactly. I do not like co-mingling groups either. Also, sudo ls is a valid command that you can run, while sudo cd is NOT!
    – MelBurslan
    Apr 8, 2016 at 14:43
  • yeah so the problem is I cant get in to the folder to 'sudo ls' actually not that 'sudo ls' is wrong. (Thanks for that). A more elegant solution is possibly to just 'sudo -s' for the duration of whatever I need to do I guess. Apr 8, 2016 at 14:47
  • oh damn im dumb, I could just sudo ls /home/userfolder Apr 8, 2016 at 14:51
0

I Wouldn't advice to become a member of all user groups, but have a look at extended ACLs instead.

Read about setfacl and getfacl on the web or the man pages and set default ACLs which allow you to enter the other home directories.

1
  • Thanks for the answer, i got that impression but had to give the answer to the other gent as he was really first. (Id have upvoted you as well but .. eh i dont even have 15 yet to do it :D). Apr 8, 2016 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .