0

I need to add special permission for new shell user. After using adduser command new, the user can read all directories into shell account.

Command adduser user1 brings us new user which has own shell directory /home/user1. Now, I need make permissions for user1 with full access only for its corresponding /home/user1 folder. Each time when user1 goes into /home folder, the user should not see anything from this folder. Same behaviour should be when user1 goes into main shell directory where we have folders etc, home, usr, var etc.

Now when I log in as user1 I can read all shell directories e.g. via Midnight Commander.

migrated from serverfault.com Feb 9 '17 at 9:42

This question came from our site for system and network administrators.

  • That special permission would actually be the normal read permissions on the directory. Remove read. For directories, x = 'cd into', r.. still means read. – yoonix Jan 25 '17 at 0:32
  • I think you can achieve this with setfacl. I wouldn't recommend it though. You'd need to recursively deny your user access to all directories and then allow him to access his home directory. This might work with one user but gets a bit ugly if you get more users. – rkhff Jan 25 '17 at 0:37
  • Perhaps you should be looking at chrooted ssh access rather than at restricting a regular user account. – Jenny D Feb 9 '17 at 9:43
2

If I understand your question correctly it's as simple as:

# chmod o-r /home/

Which results in these permission for home folder

drwxr-x--x  3 root root 4.0K Jan 25 15:08 home

others still have x permission so they can still cd to folder, but not view it's contents.

Tested in Debian 6:

test@testserver:~$ pwd
/home/test
test@testserver:~$ ls
hello
test@testserver:~$ cd ..
test@testserver:/home$ ls
ls: cannot open directory .: Permission denied

Same can be applied to other folders

  • Hello. Thank You for your time. Your answer solve the problem only to some point. When You go one folder up, you can still view content of main folder of server. – X9DESIGN Jan 25 '17 at 2:35
  • @X9DESIGN: then for that one also you need to : chmod -r / ? (but be carefull not to take away some needed rights. That one should be all right, but a bit weird for experienced users (not to be able to see "/" content is surprising)... you may need to rethink all your security strategy: maybe have untrusted users be in a "chrooted" environnement instead? or ensure their rights don't allow them to do something they shouldn't. And maybe give them a restricted shell? But for all others, keep things simple and just ensure critical things are for root (or their owners) only – Olivier Dulac Feb 9 '17 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy