Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 5 down vote favorite

Why is it that the default setting makes it possible for user A to look in the home of user B and vice versa?

And furthermore... That user can not only look into the home of another user, he can also open any document he wants to.

It feels very insecure to me. There should be more privacy for users. I know how to prevent this situation, but it puzzles me why this should be possible in the first place.

share|improve this question
This isn't a question, this is a request for a debate on the merits and cons of having /home/* 755 by default. There are better places than Ask Ubuntu. – Caesium Nov 25 '11 at 14:56

closed as not constructive by RolandiXor♦, enzotib, Jorge Castro, Bruno Pereira♦, jrg♦ Jan 2 '12 at 22:26

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

4 Answers

up vote 1 down vote

@Digiplace, I agree that it is pretty silly that any user can see your personal files, regardless of the history of UNIX, there are ways to keep your files private however by using enryption

Encrypting home directories allows you to keep your files private. Without the proper authentication, unauthorized users will not be allowed view or access the content stored in your home folder.

To get started, go to Applications –> Ubuntu Software Center.

Then search for and install ‘ecryptfs-utils’

enter image description here

After installing, ‘Encrypt home folder’ option should be enabled when creating new users.

enter image description here

If a user account is already created, and it’s not encrypted, go to Applications –> Accessories –> Terminal and run the command to encrypt an existing account.

sudo ecryptfs-migrate-home -u USERNAME

Replace USERNAME with the username of the account.

After encrypting an existing user directory, allow the user to login immediately before restarting the computer.

When the user logs in, he/she must click ‘Run this action now’ to create a passphrase (password) when prompted below.

enter image description here

When everything works ok, go to the /home folder and delete the temporary folder created for the user. If everything didn’t work, then restore the user’s home directory. But remember, a user must be logged out before you can encrypt his/her home folder.

enter image description here

share|improve this answer
Worth to note, it is not the encryption that prevent the others from seeing your files, but the default read and execute permissions used by the system when you use encryption. When both users are logged in (and so crypt-mounts in effect), with appropriate permissions each can see the files of the other. – enzotib Nov 25 '11 at 11:37
Thx but as I wrote, I know how to fix this thing. I just want to know WHY Ubuntu has chosen to use this default setting. I mean...even Windows does this better! – Digiplace Nov 25 '11 at 11:40
up vote 1 down vote

As said Ubuntu by default leaves the home from each user open for others to peak inside, its a way of facilitating access and file sharing between user accounts.

Of course each directory / file can have it's permissions changed by the user so that the files become more private. For that you can use the command chmod, read the manual pages by typing man chmod in a terminal

Also, if privacy is an issue you can during installation or a new user creation, select to encrypt the user's home. That will make the home directory of that user inaccessible to other users even if the user is currently logged in to the system (default behaviour).

You can still encrypt your home folder if you did not. For that you need the ecryptfs-utils package installed

sudo apt-get install ecryptfs-utils

Log out and log in with the guest user account (or create a temporary account for the effect), open a terminal and type:

sudo ecryptfs-migrate-home -u <username>

Where <username> is the username of the user you want to encrypt the home folder.

share|improve this answer
up vote 0 down vote

Other user cannot modify or delete your files, nor they can execute your scripts with your credentials, so it is not insecure.

Traditionally, UNIX has given the users the privilege to read almost everything in the system. Of course, as you know, if you feel you have confidential information to hide from other, you can.

share|improve this answer
1  
Unix was created and used for anything but the desktop. So I don't feel satisfied with this answer. Ubuntu wants to grow as a mainstream desktop environment. And they should. But I don't think that this specific Unix tradition comes to terms with the expectations and needs! of desktop users. – Digiplace Nov 25 '11 at 10:32
@Digiplace: Desktop are mainly used at home, in the family, where users want to share, not isolate one from the other, and at work where generally there is only one user per machine. – enzotib Nov 25 '11 at 10:42
1  
Well, I'm not a narrow minded person, mind you ;-) but I don't want my kids in my documents map on a multi user desktop. – Digiplace Nov 25 '11 at 10:46
2  
You may not be satisfied with the situation, but this is the answer - Ubuntu does it this way because Linux in general does it this way because UNIX has always done it this way. Ubuntu could choose to do it another way, but UNIX has always given you the means to control your own access permissions, so where's the advantage? – ams Nov 25 '11 at 14:21
1  
BTW, if you're really worried about keeping your documents away from you kids you should encrypt them and set the permissions to "user only" - it's only a matter of time before one of the kids discovers that booting in recovery mode gives full root access with no password required! – ams Nov 25 '11 at 14:24
show 1 more comment
up vote -1 down vote

To solve this do one thing change the permissions of your home directory /files to X00 where 00will make them inaccessible to others in your group and to any other user

chmod 0X00 home directory/file_name
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.