14

This question Unix & Linux: permissions 755 on /home/ covers part of my question but:

Default permissions on a home directory are 755 in many instances. However that lets other users wander into your home folder and look at stuff.

Changing the permissions to 711 (rwx--x--x) means they can traverse folders but not see anything. This is required if you have authorized_keys for SSH - without it the SSH gives errors when trying to access the system using a public key.

Is there some way to set up the folders / directories so SSH can access authorized_keys, postfix / mail can access files it requires, the system can access config files but without all and sundry walking the system?

I can manually make the folder 711, set ~/.ssh/authorized_keys to 644 but remembering to do that every time for every config is prone to (my) mistakes.

I would have thought by default all files were private unless specifically shared but with two Ubuntu boxes (admittedly server boxes) everyone can read all newly created files. That seems a little off as a default setting.

Improve this question

2 Answers 2

Reset to default
10

As noted in the manual by default home folders made with useradd copy the /etc/skel folder so if you change it's subfolder rights all users created after in with default useradd will have the desired rights. Same for adduser. Editing "UMASK" in /etc/login.defs will change the rights when creating home folders.

If you want more user security you can encrypt home folders and put ssh keys in /etc/ssh/%u instead of /home/%u/.ssh/authorized_keys .

Improve this answer
7
  • 1
    Thank you. Its strange, I've been using Linux server for years but never even considered the skel folder. Seems I had a blind spot in my knowledge. Thank you.
    – Shane
    Oct 13, 2016 at 22:45
  • Sounds like the most polite RTFM I've ever received :) Thanks. Like i said it is a blind spot - most of my Linux experience is on servers, no requirements for other than root user to access it. I've debugged the most arcane issues with drivers, set up highly secure servers, but never had to deal with multi user access in over 16 years. That's all been handled by Samba, DB access but we don't do ssh, scp, ftp or log on access for users - ever. Until today. TMFR'd ;)
    – Shane
    Oct 16, 2016 at 7:24
  • I don't see that in the referenced manual, nor does that seem to be the case.
    – Teekin
    Dec 9, 2017 at 20:13
  • 1
    @user1133275, I was trying to solve a different problem, i.e. trying to change the default rights of the newly created home folder itself, not a folder within it, so I misunderstood your answer to say something that it doesn't (and appropriately, it didn't work for me). Your answer makes sense in light of the question. The solution to my problem is editing "UMASK" in /etc/login.defs, in case anyone else is interested.
    – Teekin
    Dec 15, 2017 at 18:11
  • 2
    @user1133275: I downvoted it earlier, but I'd like to upvote it if you clarify that the answer regards folders within /etc/skel. The way it's now, it looks like /etc/skel's rights themselves would be copied to the newly created home folder, which is not the case. I can't upvote unless you edit it, so if you clarify it (and ping me), I'll upvote.
    – Teekin
    Dec 15, 2017 at 18:13
2

How the permissions should be set depend on the overall security policy and the use case. Back in the old days Unix machines were truly multi-user systems with several hundred users logged in concurrently via serial terminals (such as a DEC VT-220). In this scenario your point was an issue - sometimes. Unix was used a lot in academic environments such as universities where security was a lesser concern, at least lesser than seamless collaboration.

Today Unix (esp. in the incarnation Linux) is used as server system, in which case restricting home directories (there won't be too many, anyway) is rather pointless. Or, it is used for the desktop, where there is typically one user, in which case restricting home directories is also rather pointless.

Therefore, from a certain point of view you are right. Yet, it is largely irrelevant for most use cases (especially the single-user case) and their risk profile, and thus, home directory permissions 0755 are as ok as 0700, 0711 or 0777.

Appendix

However, even a single user may have several user accounts, e.g. a default one, one for online banking, and one for generic web surfing etc., such that accounts are used for a kind of sand-boxing. In such cases stricter permissions are in order.

Improve this answer
3
  • 1
    The person who has a single-user desktop doesn't have any need for more open directory permissions. The most likely reason permissions are open by default is because in certain cases other processes need to see your files. For example think of where apache is configured to serve user web pages from ~user/public_html
    – Angelo
    Apr 24, 2020 at 6:34
  • A web server on a PC (most likely a note book in these days)? Is that a useful scenario?
    – countermode
    Apr 24, 2020 at 7:56
  • 1
    The first sentence was meant to be a completely standalone statement, not to imply a web server on a desktop. The second sentence was to say the reason we went from 700 to 755 from a historical perspective was probably because of processes needing to see your files, and for collaboration. Ubuntu says 755 helps users share files. I think 700 is default on RH servers, but it's been a while since I used RH. On ubuntu you can set a different default in /etc/adduser.conf
    – Angelo
    Apr 24, 2020 at 20:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .