0

My home folder contains 2 users. 1 admin users and 1 guest.

I basically want a guest user not to be able to change the directory to a directory outside his own home folder when he logs in via SSH session.

The users look as following:

root@Ubuntu-2004-focal-64-minimal / # id olw
uid=1000(olw) gid=1002(olw) groups=1002(olw),1000(admins)
root@Ubuntu-2004-focal-64-minimal / # id guest
uid=1002(guest) gid=1001(guest) groups=1001(guest)

The home directory:

drwxr-xr-x 5 root root 4096 Jun 16 11:01 home/

From my understanding this means that others (not in root group) can read or enter(execute) this directory.

Inside this directory the file system looks as following:

drwxr-xr-x  5 root root   4096 Jun 16 11:01 ./
drwxr-xr-x 18 root root   4096 Jun 14 16:13 ../
drwxrwx---  2 root guest  4096 Jun 16 11:11 guest/
drwxr-x---  4 olw  admins 4096 Jun 15 16:12 olw/

So now the guest is able to switch back to the home directory once he is inside his own home directory because /home is executable to others.

I chmod o-rx home/ and changed to group of the home folder to admins too. Otherwise nobody except root or people inside the root group could do anything with the root folder.

drwxr-x---  5 root admins   4096 Jun 16 11:01 ./
drwxr-xr-x 18 root root   4096 Jun 14 16:13 ../
drwxrwx---  2 root guest  4096 Jun 16 11:11 guest/
drwxr-x---  4 olw  admins 4096 Jun 15 16:12 olw/

The odd thing now:

When I switch to my admin everything is working. I can go into my home folder, go outside; do everything but with the GUEST account I get a

oot@Ubuntu-2004-focal-64-minimal /home # su guest
bash: /home/guest/.bashrc: Permission denied

I cannot even read the default .bashrc file or execute an ls command.

I even switched the permission for the guest homefolder to full access from everyone ending up with:

drwxr-x---  5 root admins 4096 Jun 16 11:01 ./
drwxr-xr-x 18 root root   4096 Jun 14 16:13 ../
drwxrwxrwx  2 root guest  4096 Jun 16 11:11 guest/
drwxr-x---  4 olw  admins 4096 Jun 15 16:12 olw/

I still get the error. What am I doing wrong? I want the guest not to be able to leave his own home directory but I want him to see his own home directory and be able to execute commands there. Why is it working with the olw user?

The file system inside the users looks as following

guest

drwxrwxrwx 2 root  guest  4096 Jun 16 11:11 ./
drwxr-x--- 5 root  admins 4096 Jun 16 11:01 ../
-rw------- 1 guest guest    42 Jun 16 11:22 .bash_history
-rwxrwxrwx 1 root  guest   220 Jun 15 15:00 .bash_logout*
-rwxrwxrwx 1 root  guest  3771 Jun 15 15:00 .bashrc*
-rwxrwxrwx 1 root  guest     0 Jun 15 15:00 .cloud-locale-test.skip*
-rwxrwxrwx 1 root  guest   807 Jun 15 15:00 .profile*
-rwxrwxrwx 1 root  guest    20 Jun 15 15:14 WELCOME.txt*

olw

drwxr-x--- 4 olw  admins 4096 Jun 15 16:12 ./
drwxr-x--- 5 root admins 4096 Jun 16 11:01 ../
-rwxr-x--- 1 olw  olw     960 Jun 16 11:35 .bash_history*
-rwxr-x--- 1 olw  olw     220 Jun 15 14:38 .bash_logout*
-rwxr-x--- 1 olw  olw    3771 Jun 15 14:38 .bashrc*
drwx------ 2 olw  olw    4096 Jun 15 15:54 .cache/
-rwxr-x--- 1 olw  olw       0 Jun 15 14:38 .cloud-locale-test.skip*
drwxrwx--x 3 olw  olw    4096 Jun 15 15:10 .local/
-rwxr-x--- 1 olw  olw     807 Jun 15 14:38 .profile*

13
  • 1
    Welcome! Besides your actual problem, always be very careful when applying permissions recursively, you can end with a broken system. Jun 16 at 13:21
  • 1
    It is not possible to do it, you cannot deny a user access to /home if his $HOME is below that. One needs access to the whole directory tree. Also, he needs access to other resources in e.g. bin, lib or etc, otherwise nothing will work. What is your actual problem, why do you want to do that?
    – pLumo
    Jun 16 at 13:22
  • 1
    You need chmod a+x /home to be able to access something in /home as a user that is neither the user or group of /home. /home/guest and the files in it should normally be owned by user guest, not root and should probably have the same permission bits (not owner/group) as the files/directories of olw
    – Bodo
    Jun 16 at 13:22
  • 1
  • Please edit your question and add more details. What exactly do you mean with "... not to be able to leave his own home directory"? What should the user be able to do? What do you want to prevent?
    – Bodo
    Jun 16 at 13:32
0

All file access depends on the permissions of the file and the directory hierarchy it exists in.

While there are a couple of ways of achieving the result you desire, these are non-trivial and you may be breaking other parts of the security of your server. For example, you could set the homedir for guest to /other/guest - but in order to exclude them from /home you need to create a group encompassing all other users and set the group ownership of /home to that group and chmod o-rwx /home. But you're still not done. In addition to filesystem permissions, your Ubuntu box has a security subsystem called apparmor - this uses a more centralized database of objects (not just files) users and the permissions linking them - that will need updating too.

I'd like to think I know my way around Linux but this looks to me like a scarily complex task with little apparent benefit.

1
  • Hmm i see.... Didn't think that this would be such a complex task. I thank you all for you answers !!
    – MajesticOl
    Jun 17 at 7:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.