Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I prevent users accessing anything but their own home directory?

For example, I have a NTFS partition mounted under /media/ntfs, so if the user logs in through ssh he can reach this partition. How can I disable the users to cd out from their home directory?

share|improve this question
up vote 14 down vote accepted

Reassess your requirement first. What is the problem you are trying to solve? Why do you want to prevent users from leaving their home directory? Isn't it rather that you don't want them to nose around in specific other directories -- such as the home directories of other users?

It is very difficult to prevent users from leaving their home directory. It is actually a bit silly, too (explanation follows). It is much simpler to prevent users from entering directories you don't want them to enter.

First off, yes you can give users a so-called restricted shell, see man rbash. This will prevent them to cd, but only inside that shell. If the user starts vi or nano (or any other program capable of opening a file) they can again open files anywhere on the system. As a matter of fact, a restricted shell does not prevent e.g. cat /etc/passwd.

The next step up is a root jail. More info on the community wiki and in this question. Though a root jail will lock a user inside a walled garden, within which she has access to nothing but the files and commands that you put there, root jails really are intended for isolating untrusted software rather than users. In particular, they are for software that needs to run with elevated privileges -- hence a root jail.

A user, on the other hand, is trusted: he has had to authenticate and runs without elevated privileges. Therefore file permissions suffice to keep him from changing files he does not own, and from reading things he must not see. World-readability is the default though, for good reason: users actually need most of the the stuff that's on the file system. To keep users out of a directory, explicitly make it inaccessible: chmod -R o-rwx. Don't lock users in their homes (ooh! wouldn't we sometimes love to do that!) because there are secrets outside of it.

PS: Why locking users in their home directory is a bit silly:

Users need access to commands and applications. These are in directories like /usr/bin, so unless you copy all commands they need from there to their home directories, users will need access to /bin and /usr/bin. But that's only the start. Applications need libraries from /usr/lib and /lib, which in turn need access to system resources, which are in /dev, and to configuration files in /etc. This was just the read-only part. They'll also want /tmp and often /var to write into. So, if you want to constrain a user within his home directory, you are going to have to copy a lot into it. In fact, pretty much an entire base file system -- which you already have, located at /.

share|improve this answer

I needed to provide access to user sam on /var/xyz only and block listing contents of other folders inside /var/

I used the following sequence of commands:

setfacl -R -m user:sam:--- /var/

setfacl -m user:sam:rx /var/

setfacl -R -m user:sam:rwx /var/xyz/

So the user can see directories listed under /var/ but cannot see contents under sub directories except /var/xyz.

share|improve this answer
Welcome to askubuntu! I don't see this as an answer to the question asked regarding home directories. – Elder Geek Jan 29 '15 at 21:57
@ElderGeek Can't the OP just use the same commands, but for the home directory? – Seth Jan 30 '15 at 4:25
@Seth Yes, but would that be clear to the average user? – Elder Geek Jan 30 '15 at 14:39
@Elder Yes, I believe it would. Not perfect, but still an answer – Seth Jan 30 '15 at 16:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.