3

I have several folders:

/home/user1/ -u user1 -G user1
/home/user2/ -u user2 -G user2
/home/user3/ -u user3 -G user3

I created three users user1, user2, user3. Each user has their own group. Any user can see other account folder for a while but cannot open it.

After user2 logged in using ssh they shouldn't see any folders downto its folder /home/user2/. They should see only folders in /home/user2/.

How to set these permissions?

Improve this question

2 Answers 2

Reset to default
4

If you use chmod to set only set the x bit for group and other on /home - This disallows reading /home (ls will fail on /home), but the x bit allows traversal to known sub-directories.

And also set no access for group and other on sub-directories in /home ie the user directories.

If you are the user root, the commands would be:

chmod go=x /home 
chmod go-rwx /home/user[123]

Then user2 will only be able to see the files in user2's home directory and ls on /home, /home/user1 and /home/user3 will fail; ls: cannot open directory 'directory-name': Permission denied

Improve this answer
5
  • 6
    This way, the users won't be able to list directories in /home (which requires read permission on /home, which you're revoking assuming sane ownership), but it won't prevent them from knowing about those directories because all users' home directories are likely named in /etc/passwd, which is world readable.
    – user
    Commented Aug 5, 2013 at 12:50
  • 1
    @MichaelKjörling Yes, but there is no good way around that, apart from making /etc/passwd unreadable for users. The OP requested the directories "not to be seen", which this accomplishes.
    – peterph
    Commented Sep 26, 2013 at 16:49
  • @peterph True, but I still think it's an important caveat. Whether or not it is important depends on the exact use case.
    – user
    Commented Sep 29, 2013 at 16:47
  • @MichaelKjörling sure - actually the requirement is quite strange - there are lots of ways to get names (and the likely location of their home directories) of at least some users on a system.
    – peterph
    Commented Sep 30, 2013 at 19:06
  • chmod go-rwx /home/* worked in my case. You might have to use sudo for permission to run the command.
    – ckhatton
    Commented Jun 2, 2021 at 14:10
1

It depend on system that you use.

There are many MAC implementations, Mandatory Access Control.

FreeBSD famous for its MAC. (see handbook)

Look at OpenBSD's systrace, its wrapper around shell give you a total control over what user can or can not do and see.

Linux rejoices by large of amount such systems. Look at SELinux, AppArmor, see also Grsecurity patch...

The easiest way and most popular is to put user into chroot(Linux), lxc-container(Linux), jail(FreeBSD), and many more...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .