0

I need to add special permission for new shell user. After using adduser command new, the user can read all directories into shell account.

Command adduser user1 brings us new user which has own shell directory /home/user1. Now, I need make permissions for user1 with full access only for its corresponding /home/user1 folder. Each time when user1 goes into /home folder, the user should not see anything from this folder. Same behaviour should be when user1 goes into main shell directory where we have folders etc, home, usr, var etc.

Now when I log in as user1 I can read all shell directories e.g. via Midnight Commander.

Improve this question
3
  • That special permission would actually be the normal read permissions on the directory. Remove read. For directories, x = 'cd into', r.. still means read.
    – yoonix
    Jan 25, 2017 at 0:32
  • I think you can achieve this with setfacl. I wouldn't recommend it though. You'd need to recursively deny your user access to all directories and then allow him to access his home directory. This might work with one user but gets a bit ugly if you get more users.
    – rkhff
    Jan 25, 2017 at 0:37
  • Perhaps you should be looking at chrooted ssh access rather than at restricting a regular user account.
    – Jenny D
    Feb 9, 2017 at 9:43

1 Answer 1

Reset to default
2

If I understand your question correctly it's as simple as:

# chmod o-r /home/

Which results in these permission for home folder

drwxr-x--x  3 root root 4.0K Jan 25 15:08 home

others still have x permission so they can still cd to folder, but not view it's contents.

Tested in Debian 6:

test@testserver:~$ pwd
/home/test
test@testserver:~$ ls
hello
test@testserver:~$ cd ..
test@testserver:/home$ ls
ls: cannot open directory .: Permission denied

Same can be applied to other folders

Improve this answer
2
  • Hello. Thank You for your time. Your answer solve the problem only to some point. When You go one folder up, you can still view content of main folder of server.
    – X9DESIGN
    Jan 25, 2017 at 2:35
  • @X9DESIGN: then for that one also you need to : chmod -r / ? (but be carefull not to take away some needed rights. That one should be all right, but a bit weird for experienced users (not to be able to see "/" content is surprising)... you may need to rethink all your security strategy: maybe have untrusted users be in a "chrooted" environnement instead? or ensure their rights don't allow them to do something they shouldn't. And maybe give them a restricted shell? But for all others, keep things simple and just ensure critical things are for root (or their owners) only
    – Olivier Dulac
    Feb 9, 2017 at 9:54

You must log in to answer this question.