41

How can I prevent users accessing anything but their own home directory?

For example, I have a NTFS partition mounted under /media/ntfs, so if the user logs in through ssh he can reach this partition. How can I disable the users to cd out from their home directory?

6 Answers 6

31

Reassess your requirement first. What is the problem you are trying to solve? Why do you want to prevent users from leaving their home directory? Isn't it rather that you don't want them to rummage through specific other directories -- such as the home directories of other users?

It is very difficult to prevent users from leaving their home directory. It is actually a bit silly, too (explanation follows). It is much simpler to prevent users from entering directories you don't want them to enter.

First off, yes you can give users a so-called restricted shell, see man rbash. This will prevent them from cd-ing elsewhere, but only inside that shell. If the user starts vi or nano (or any other program capable of opening a file) they can again open files anywhere on the system. As a matter of fact, a restricted shell does not prevent e.g. cat /etc/passwd.

The next step up is a root jail. More info on the community wiki and in this question. Though a root jail will lock users inside a walled garden, within which they have access to nothing but the files and commands that you intentionally put there, root jails really are intended for isolating untrusted software rather than users. In particular, they are for software that needs to run with elevated privileges -- hence a root jail.

Users, on the other hand, are trusted: they have had to authenticate and run without elevated privileges. Therefore file permissions suffice to keep them from changing files they do not own, and from seeing things they must not see. To prevent users from reading the content of a file, remove its world-readability with chmod o-r FILE . To keep users out of a directory, make it world-inaccessible with chmod o-rwx DIR.

World-readability is the default though, for good reason: users actually need most of the stuff that's on the file system. Don't lock users in their homes just because there exist secrets outside.

Why locking users in their home directory is a bit silly

To do anything useful, users need access to commands and applications. These are in directories like /bin and /usr/bin, so unless you copy all commands they need from there to their home directories, users will need access to /bin and /usr/bin. But that's only the start. Applications need libraries from /usr/lib and /lib, which in turn need access to system resources, which are in /dev, and to configuration files in /etc and /usr/share.

This was just the read-only part. Applications will also want /tmp and often /var to write into. So, if you want to constrain a user within his home directory, you are going to have to copy a lot into it. In fact, pretty much an entire base file system -- which you already have, located at /.

2
  • 17
    This doesn't make sense to me, there could be so many reasons why you would want a user to only have access to 1 folder. One example could be giving access for the sake of transmitting files from 1 server to another. I rather think that it's a bit silly that any user can browse the full system instead.
    – Richard
    Mar 28, 2018 at 14:51
  • 1
    In my case I am setting up a user to allow devices to reverse ssh into the machine for remote management of devices. So I want to limit that user account as much as possible just in case it's compromised - I just need the successful connection to be made. I wouldn't say it's silly, it just depends on what you are trying to accomplish.
    – John
    Dec 9, 2018 at 13:50
13

I needed to provide access to user sam on /var/xyz only and block listing contents of other folders inside /var/

I used the following sequence of commands:

setfacl -R -m user:sam:--- /var/

setfacl -m user:sam:rx /var/

setfacl -R -m user:sam:rwx /var/xyz/

So the user can see directories listed under /var/ but cannot see contents under sub directories except /var/xyz.

5
  • 2
    Welcome to askubuntu! I don't see this as an answer to the question asked regarding home directories.
    – Elder Geek
    Jan 29, 2015 at 21:57
  • 6
    @ElderGeek Can't the OP just use the same commands, but for the home directory?
    – Seth
    Jan 30, 2015 at 4:25
  • @Seth Yes, but would that be clear to the average user?
    – Elder Geek
    Jan 30, 2015 at 14:39
  • 5
    @Elder Yes, I believe it would. Not perfect, but still an answer
    – Seth
    Jan 30, 2015 at 16:43
  • if folder is /var/abc/xyz then setfacl -m user:sam:rx /var/abc/ . This works for me
    – Aravind
    Jun 4, 2020 at 11:07
11

To complete the answer of @Willman, you can simply do this :

First, for users to not list all users home directories :

chmod 701 /home

But if you know the path of a user's home directory, you can still access it with cd.

So you could just chmod 750 all of your already-created users directories.

But what we want here is to prevent any new user's home directory to have a 755 permission on it. There is a file responsible of the configuration of new users : /etc/adduser.conf :

Just change DIR_MODE=0755 to DIR_MODE=0750

1
  • In general one should always set /home directories to 750, such that all users of the within the group can r and x the content of the folder. For shared folders also 760 makes sense. Then control the access via the user group. This is actually the main strength of the user groups to allow a role based access control. It maybe makes also sense to check how you can add a user to several different groups. Nov 28, 2023 at 17:18
6

In addition to restricting access to other directories, particularly other users' home directories, I also didn't want a user to ll /home and see the names of the other users on the system.

To prevent this, as root run chmod 701 /home. This makes the /home directory itself "read/write/execute" to root of course, but only "execute" to everyone else. /home is still accessible to cd to, but users cannot read its contents- the other users' home folders and therefore usernames.

2
  • This, although not strictly an answer to the question, is still very interesting... In a situation where you operate a remote server that clients can ssh in to, this is great. They can still move around as they'd expect, whilst retaining the privacy of other clients usernames.
    – Jack_Hu
    Jun 1, 2018 at 19:12
  • This was exactly the answer I was looking for. Nov 29, 2020 at 7:50
2

This is what worked for me:

sudo adduser --home /the/only/accessed/directory baby_user --no-create-home

chown baby_user:baby_user /the/only/accessed/directory

chmod 755 /the/only/accessed/directory

Then:

setfacl -m user:baby_user:rx /the/only/accessed/directory

And voila baby_user cannot cd upwards ...

1
  • Honestly this is the easiest solution here to solve the issue. I don't understand why it did not get more upvotes yet. Nov 28, 2023 at 17:11
2

This worked for me:

  1. Run the following command:

    vi /bin/restrictedbash
    
  2. Then add the following to the file:

    #!/bin/bash
    bash --restricted
    
  3. Then change the permissions of the file using the following command:

    chmod 755 /bin/restrictedbash
    
  4. Then run the following command to edit the passwd file:

    vi /etc/passwd
    
  5. Then replace the line that belongs to the user as follows:

    ali:x:1001:1001:,,,:/home/ali:/bin/bash
    

    with

    ali:x:1001:1001:,,,:/home/ali:/bin/restrictedbash
    

Then user ali will be restricted to his own home directory.

2
  • ... what stops ali from just shipping his own unrestricted bash and running that from his restricted bash? is ali's home directory on a readonly filesystem? is ali's home directory mounted with noexec ?
    – hanshenrik
    Jun 18, 2022 at 8:00
  • This works well for ssh login using command line, however, if you try to use SFTP on filezilla its not wokring. Any solution? Apr 30, 2023 at 17:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .