0

Recently I had a project which was about ssh connection with an Amazon EC2 server. In this project I was asked to create a user than can have read permissions -only- to the whole server (all files in it). I searched how to do that and the majority of the answers was with the command

chown -R

They mentioned that this command changes the owner of the files and I didn't want to do that, so what I did (I am new to Linux, I don't know a lot of things) was to add the read permissions to the root file with the command

chmod 755 /

After that I could not connect to the server anymore, so I guess it was a bad move. My question is if there was a way that I could do that without touching the root file and without changing the ownership of the files. Also I would like to ask if the root file should not be touched in general, whatever the task is.

  • There is no such thing as a "root file" strictly speaking - root is the topmost level of your filesystem. – Panki May 17 at 11:23
  • 2
    That is a horrible idea. There are certain files such as /etc/sudoers that need to have certain permissions including only being readable by root. Changing those permissions makes it so that it isn't possible to gain root user rights. There are many other examples but I'm sure you get the idea. – Nasir Riley May 17 at 11:55
  • So,as I understand, if i change the permissions to all files, i loose my access to the root, that's why i couldn't connect to it again, right; So by saying give read permissions to the whole server means give permissions to everything that i add to the server and not these that already exist in it? – john May 17 at 12:26
  • 1
    If the command you used was exactly chmod 755 /, then it only set the permissions of the root directory to drwxr-xr-x... which is exactly what they normally are, so that command should not have been harmful. But if you added the -R option... then it becomes horrible. – telcoM May 17 at 12:41
  • @Christopher To give read permission to this user to the whole server wasn't part of a solution that i thought for a problem, it was clearly requested from the exercise. Through this user, my teacher would connect to the server with his ssh key and check everything that i have done there. That's why he asked read permission everywhere – john May 17 at 16:11
0

You likely set the .ssh and .ssh/authorized_keys of you user to 755, making SSH believe the key has been compromised (SSH requires these to have read/write access only for their owner).

On a normal system, no user except root has universal read access. Blanket read permissions are a bad idea(*), consider determining the real needs and setting access rights only where needed and reasonably safe (/var/log). And even then making the directory universally readable is better avoid; either to add the specific user to some group that has read access or use ACLs to fine tune accesses.

(*) Exemple: with read access, someone can obtain the private key of your server. This is the key that identifies your server when you login with SSH. By copying this key to another server you could be tricked into logging in on a fake server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.