0

asumming a system where only 1 new user was added and was given root (administrator) privileges.

we want to keep the user files within the user home directoy safe, meaning the no other user (except root) could access the files\directories.

this can be done using umask, but umask sets the permission globaly on the file system and not only for the user home directory.

we would like to keep the default file and directory permissions out side of the user home directory since the user is used to administer and install executables outside of the user home directory so other user could use it.

could you please advise what is the best parctice to achieve the above?

tl;dr: how to harden the root (administrator) file and directory permission while still letting other access general exeutables installed by the root user.

Improve this question
2
  • 1
    What's wrong with chmod 700 /home/user?
    – fkraiem
    Jul 17, 2019 at 6:58
  • well you want that on the directories and would need to redo it on creation of every new directory.
    – Rinzwind
    Jul 17, 2019 at 7:04

1 Answer 1

Reset to default
1

See DIR_MODE in /etc/adduser.conf

# If DIR_MODE is set, directories will be created with the specified
# mode. Otherwise the default mode 0755 will be used.
DIR_MODE=0755

What you want is 0700 and nobody else will be allowed to enter the directories created in /home/$USER/ except for $USER and root.

Optional: there is also 

/etc/pam.d/common-session

See the ...

# The pam_umask module will set the umask according to the system default in
# /etc/login.defs and user settings, solving the problem of different
# umask settings with different shells, display managers, remote sessions etc.
# See "man pam_umask".

adding 

session optional pam_mkhomedir.so to session optional pam_mkhomedir.so umask=0077

Does the same (umask is reversed to chmod so 0077 for a chmod 0700)

Improve this answer
5
  • could you please clarify how modifying the umask willl affect only the files that are created within the user home directory?
    – Mr.
    Jul 17, 2019 at 7:39
  • Use the 1st option; chmod in logindefs. That's the default location. And why would that need to affect the files? You alter the directories created for the user (so Desktop, Downloads etc) and make then inaccessible for other users). The permissions to the files in them then don't matter
    – Rinzwind
    Jul 17, 2019 at 7:52
  • i am always asking the same question and your answer does not give me a definitive answer. please read the tl;dr in my post or the question in the comment above.
    – Mr.
    Jul 17, 2019 at 8:08
  • Look at setting the sticky bit on the directory. Also, if the user sets umask on login manually or in such places as.bashrc, it affects only that user's files, not the rest of the system. Further, check out the suid and sgid bits as they may provided additional security you can take advantage of.
    – jpezz
    Jul 17, 2019 at 12:27
  • @jpezz: using a sticky bit does not answer my question.
    – Mr.
    Jul 17, 2019 at 12:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .