2

I'm about to create user and set it's home directory inside another user's home directory - I'm wanderin' is it:

  • allowed in *nix world

  • possible (I haven't tried in test box yet)

  • and does it have any recognized negative aspect?

Case:

ftp_user1 home dir is /var/www/vhosts/website/

I want

ftp_user2 home dir to be /var/www/vhosts/website/subfolder/

(of course, I'm aware that I will have to chose one user which will be owner of /var/www/vhosts/website/subfolder/)

1

allowed in *nix world

Practically anything is allowed in the *nix world.

possible (I haven't tried in test box yet)

Yes, this is possible. When a user is assigned a home directory, that is the directory that the user will cd to by default when logging in. You can change ftp_user2's home directory with the -d option in usermod:

usermod -d [directory] [ftp_user2]

In your case, it would look like this: usermod -d /var/www/vhosts/website/subfolder ftp_user2

If you still need to create ftp_user2, you can assign their home directory while creating them using useradd.

useradd -m -d /var/www/vhosts/website/subfolder -s /bin/bash ftp_user2

The -m option will create the user's home directory if it does not already exist. The -d option specifies which home directory is to be assigned to the user. The -s option specifies what shell that user will use when logged in. -s is not needed, but it is usually good practice to specify a users default shell if that user will be logged in to.

and does it have any recognized negative aspect?

The only negative aspect I can think of is: If someone decides to delete ftp_user1 and their home directory, then the home directory for ftp_user2 will also be deleted.

  • I also recommend looking at the man pages for useradd and usermod. – Peschke Jun 1 '16 at 16:56
0

It's possible for a user's home directory to be inside another, but it's rare, for good reason. Usually, a user can write to their home directory. If ftp_user1 can write to /var/www/vhosts/website/ then ftp_user1 can rename /var/www/vhosts/website/subfolder and can create a new directory by that name, belonging to ftp_user1 and with contents chosen by ftp_user1. For example:

mv /var/www/vhosts/website/subfolder /var/www/vhosts/website/subfolder.user2
mkdir /var/www/vhosts/website/subfolder
echo 'cp /bin/sh /tmp/sh.user2; chmod u+s /bin/sh.user2' >/var/www/vhosts/website/subfolder/.profile

The next time ftp_user2 logs in, their .profile will run and create a setuid shell, which allows ftp_user1 (and anyone else) to gain access to the ftp_user2 account. (Of course this proof-of-concept can be made more robust.)

If ftp_user1 cannot write to their home directory, then this can be safe, but it is somewhat confusing. There's probably a better way to do whatever drove you to this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.