I want to disallow reading of files in my home directory by other users. How should I accomplish this? Should I use encryption? If so, how do I do that?
If you mean the files in /home, you're right. The default folder permissions are 755 (readable and executable/accessible by others).
You can change the default permissions for all folders by editing the file
/etc/adduser.conf- Find the line:
To block others, change it to:
To also block people in the same group (see
ls -l /home) change it to:
Changes will take effect when you create a new user.
You can also change the default umask value - edit the file
The default umask 002 used for normal user. With this mask default directory permissions are 775 and default file permissions are 664.
The default umask for the root user is 022 result into default directory permissions are 755 and default file permissions are 644.
For directories, the base permissions are (rwxrwxrwx) 0777 and for files they are 0666 (rw-rw-rw).
A umask of 022 allows only you to write data, but anyone can read data.
A umask of 077 is good for a completely private system. No other user can read or write your data if umask is set to 077.
A umask of 002 is good when you share data with other users in the same group. Members of your group can create and modify data files; those outside your group can read data file, but cannot modify it. Set your umask to 007 to completely exclude users who are not group members.
You can change the default file/folder permissions (i.e. when you create a new file) of a specific folder by using these commands:
chmod g+s /folder/mypath #set sticky bit setfacl -d -m g::rwx /folder/mypath #set group to rwx default setfacl -d -m o::000 /folder/mypath #set other
Verify the change:
For clarification, the /root folder is by default set as non-readable:
$ ls -ld /root drwx------ 9 root root 4096 Jul 27 19:00 /root
You can instantly change the permissions of existing files/folders using the chmod and chown commands, described here: http://www.cyberciti.biz/faq/how-to-use-chmod-and-chown-command/
Same effect can be accomplished by right-clicking on a file/folder > properties > permissions
I found the way. You have to set permissions for users by using folders' properties. But this should be done by default that No One Should Access Administrative's personal files!
For your personal home folder, (You should have ownership)
- click the home folder icon at the top of the navigation bar on the left.
- navigate up one tier to the /home folder
- you should see a folder with your name on it.
- Right click on that folder and select "Properties".
- Select the "Permissions" tab.
- From here you can select what access you want people in your group, or others to have to the files in this folder.
- You can also check the "Apply these permissions to contents" box to apply these same permissions to the rest of the folders and files in your home directory.
You may want to encrypt your files. That is entirely up to you. If you choose to encrypt your files, look in the software center for some options. I've used Truecrypt in the past and was satisfied with it's performance.
Prevent seeing and accessing your folders and files by other user accounts:
- Open Nautilus (file explorer)
- Select your home folder (/home/your_name)
- Right click, Properties and open tab "permissions"
- You will see options for Owner, Group and Others. By default Others has "access files" set. Change Folder Access to None and File access to None.
- Click Apply Permissions to Enclosed Files to propagate the same settings to every file within your home.
This will prevent anyone else to see and access your folders and files.
Let say your folder is OKBAI and you want only root user to access.
Just run this command.
sudo chown -R root:root OKBAI
sudo chmod 0750 OKBAI
But this method not very practical. Just simple way to prevent your guest from accessing your folder. If i got any wrong here, please let me know.