0

I'm setting up local hosting, and I need to configure user system as on popular hosting providers.

For example: I create user 'user1' in group, for example, 'users'. And I gave him home folder /user/user1.

In some hosting providers, when we connect to our account via SSH of SFTP, we find ourselves in our home directory (in my case it's /user/user1). But, we can't access to /user folder. We can't access to /home, /var and other directories, but we can access to /bin and other service directories.

Chroot is bad thing there, because if we use chroot, we need to copy all bin and some system files in our user folder (because user will use shell).

I only need to close access by user group to parent directory (/user), some my folders (/etc, /home) and other /user/ folders, but give access to home directory (for user1 it is /user/user1).

How can I do this?

I tried:

sudo chmod 000 /user
sudo chmod 777 /user/user1

But when I tried to cd /user/user1 I got "permission denied" error.

How to fix this mistake and configure this correct?

0

To be able to traverse a directory, the directory needs +x (execute permission). To be able to list the content of a directory, the directory needs +r (read permission).

[/tmp]$ mkdir -p foo/bar
[/tmp]$ chmod 111 foo
[/tmp]$ cd foo
[/tmp/foo]$ ls
ls: cannot open directory '.': Permission denied
[/tmp/foo]$ cd bar
[/tmp/foo/bar]$ 

1 is octal permission for execute (+x), but no other permission, for owner, group and other. On /users you probably want 711, as root is owner (and has full control), but execute only for others. Thus, I'm able to change into a subdirectory, but unable to list the content of the directory.

As others have execute, anyone will be able to change into a subdirectory, provided they know the name of it.

You may also want to look into for instance SELinux or Apparmour, which can limit permissions in a more granular and flexible way than simple file permissions.

In short:

  • The execute bit allows users to enter a directory, and access files and directories inside it.
  • The read bit allows users to list the content of a directory.
  • The write bit allows users to create files and directories inside it.
  • The sticky bit only allows owner (or root) to modify a file or directory inside it.

This article provides some informations on how file system permissions work on Linux (and other Unices).

  • Thanks, it works! I have one question more: can I close access to folder only for user group without changing owner to this group? – entropy177 Apr 16 '18 at 16:11
  • No, traditional Unix permissions only allows permissions for owner, group and others. However, you can use ACLs for this. Access Control List are a lot more flexible and fine grained - and a lot harder to maintain. – vidarlo Apr 16 '18 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.