14

I want to disallow reading of files in my home directory by other users. How should I accomplish this? Should I use encryption? If so, how do I do that?

2
  • 2
    Could you add what you discovered. And also specify the type of users that you have added in your Ubuntu installation. Also the Ubuntu version you are using.
    – saji89
    Oct 14, 2012 at 9:19
  • 3
    What do you mean by "administrative files"? In which folder/file path? Oct 14, 2012 at 9:20

5 Answers 5

13
  1. If you mean the files in /home, you're right. The default folder permissions are 755 (readable and executable/accessible by others).

    You can change the default permissions for all new folders by editing the file /etc/adduser.conf - Find the line...:

    DIR_MODE=0755
    

    To block others, change it to:

    DIR_MODE=0750
    

    To also block people in the same group (see ls -l /home) change it to:

    DIR_MODE=0700
    

    Changes will take effect when you create a new user.

  2. You can also change the default umask value - edit the file /etc/login.defs:

    The default umask 002 used for normal user. With this mask default directory permissions are 775 and default file permissions are 664.

    The default umask for the root user is 022 result into default directory permissions are 755 and default file permissions are 644.

    For directories, the base permissions are (rwxrwxrwx) 0777 and for files they are 0666 (rw-rw-rw).

    In short,

    A umask of 022 allows only you to write data, but anyone can read data.

    A umask of 077 is good for a completely private system. No other user can read or write your data if umask is set to 077.

    A umask of 002 is good when you share data with other users in the same group. Members of your group can create and modify data files; those outside your group can read data file, but cannot modify it. Set your umask to 007 to completely exclude users who are not group members.

    Source: http://www.cyberciti.biz/tips/understanding-linux-unix-umask-value-usage.html

  3. You can change the default file/folder permissions (i.e. when you create a new file) of a specific folder by using these commands:

    chmod g+s /folder/mypath  # set sticky bit 
    setfacl -d -m g::rwx /folder/mypath  # set group to rwx default 
    setfacl -d -m o::000 /folder/mypath  # set other
    

    Verify the change:

    getfacl /folder/mypath
    

    Source: https://unix.stackexchange.com/questions/1314/how-to-set-default-file-permissions-for-all-folders-files-in-a-directory

    https://www.linuxquestions.org/questions/linux-desktop-74/applying-default-permissions-for-newly-created-files-within-a-specific-folder-605129/

    For clarification, the /root folder is by default set as non-readable:

    $ ls -ld
    /root drwx------ 9 root root 4096 Jul 27 19:00 /root
    
  4. You can instantly change the permissions of existing files/folders using the chmod and chown commands, described here: http://www.cyberciti.biz/faq/how-to-use-chmod-and-chown-command/

    Same effect can be accomplished by right-clicking on a file/folder > properties > permissions

4
  • Thanks for your answer. However I changed it by going to folder's properties for which I don't want anyone to see. And running /etc/adduser.conf giving me 'permission denied'. I don't know why.
    – rainlover
    Oct 14, 2012 at 9:48
  • You need administrative privileges to change any system file (i.e. any file not in your /home). Try: sudo gedit /etcc/adduser.conf Oct 14, 2012 at 9:50
  • oh. I was wrong. I used terminal. But now I went to that adduser.conf and found that the number is still 0755 even no one can access my personal files now. I've changed it in folder's properties. Is everything okay now? I got what I want. But still if you can discover any tiny problem!
    – rainlover
    Oct 14, 2012 at 9:53
  • 1
    It's not a problem per se. The system administrator should decide and change the user/folder/file permissions. You can do that using the chmod command: cyberciti.biz/faq/how-to-use-chmod-and-chown-command -- You fixed your problem using "Folder properties/permissions", that's one way to fix it. Oct 14, 2012 at 9:56
2

Let say your folder is OKBAI and you want only root user to access.

Just run this command.

sudo chown -R root:root OKBAI

sudo chmod 0750 OKBAI

But this method not very practical. Just simple way to prevent your guest from accessing your folder. If i got any wrong here, please let me know.

1

Prevent seeing and accessing your folders and files by other user accounts:

GUI:

  1. Open Nautilus (file explorer)
  2. Select your home folder (/home/your_name)
  3. Right click, Properties and open tab "permissions"
  4. You will see options for Owner, Group and Others. By default Others has "access files" set. Change Folder Access to None and File access to None.
  5. Click Apply Permissions to Enclosed Files to propagate the same settings to every file within your home.

This will prevent anyone else to see and access your folders and files.

0

I found the way. You have to set permissions for users by using folders' properties. But this should be done by default that No One Should Access Administrative's personal files!

2
  • 1
    Ubuntu was designed to allow easy sharing of files. It was status-by-design. Though even I prefer better privacy, I can't blame Ubuntu.
    – Mahesh
    Oct 14, 2012 at 9:59
  • I would file a bug if I were you at bugs.launchpad.net/ubuntu/+source/adduser/+filebug but please read this note from file /etc/login.defs: UMASK is the default umask value for pam_umask and is used by useradd and newusers to set the mode of the new home directories. 022 is the "historical" value in Debian for UMASK 027, or even 077, could be considered better for privacy There is no One True Answer here : each sysadmin must make up his/her mind. Oct 14, 2012 at 10:00
0

For your personal home folder, (You should have ownership)
- click the home folder icon at the top of the navigation bar on the left.
- navigate up one tier to the /home folder
- you should see a folder with your name on it.
- Right click on that folder and select "Properties".
- Select the "Permissions" tab.
- From here you can select what access you want people in your group, or others to have to the files in this folder.
- You can also check the "Apply these permissions to contents" box to apply these same permissions to the rest of the folders and files in your home directory.

You may want to encrypt your files. That is entirely up to you. If you choose to encrypt your files, look in the software center for some options. I've used Truecrypt in the past and was satisfied with it's performance.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .