3

I have several folders:

/home/user1/ -u user1 -G user1
/home/user2/ -u user2 -G user2
/home/user3/ -u user3 -G user3

I created three users user1, user2, user3. Each user has their own group. Any user can see other account folder for a while but cannot open it.

After user2 logged in using ssh they shouldn't see any folders downto its folder /home/user2/. They should see only folders in /home/user2/.

How to set these permissions?

3

set x bit for group and other on /home set no access for group and other on user directories /home/user?

chmod go=x /home 
chmod go-rwx /home/user[123]
  • 6
    This way, the users won't be able to list directories in /home (which requires read permission on /home, which you're revoking assuming sane ownership), but it won't prevent them from knowing about those directories because all users' home directories are likely named in /etc/passwd, which is world readable. – a CVn Aug 5 '13 at 12:50
  • @MichaelKjörling Yes, but there is no good way around that, apart from making /etc/passwd unreadable for users. The OP requested the directories "not to be seen", which this accomplishes. – peterph Sep 26 '13 at 16:49
  • @peterph True, but I still think it's an important caveat. Whether or not it is important depends on the exact use case. – a CVn Sep 29 '13 at 16:47
  • @MichaelKjörling sure - actually the requirement is quite strange - there are lots of ways to get names (and the likely location of their home directories) of at least some users on a system. – peterph Sep 30 '13 at 19:06
1

It depend on system that you use.

There are many MAC implementations, Mandatory Access Control.

FreeBSD famous for its MAC. (see handbook)

Look at OpenBSD's systrace, its wrapper around shell give you a total control over what user can or can not do and see.

Linux rejoices by large of amount such systems. Look at SELinux, AppArmor, see also Grsecurity patch...

The easiest way and most popular is to put user into chroot(Linux), lxc-container(Linux), jail(FreeBSD), and many more...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.