8

I am trying to restrict access to my home directory so as to prevent another user from accessing it, even another that user also has sudo permissions.

I've tried the following commands to achieve this

sudo chmod 0750 /home/user    
sudo chmod 0755 /home/user

but if other user have sudo permissions they can change the permissions easily using

sudo chmod 0755 /home/user

Is there another way around this?

13

You can't do that. If you give sudo permission for user, he can execute any command or access any files on that system. If you don't trust your user, give him restrictive sudo access to execute only a few commands by editing /etc/sudoers file. Create a new group admins

Add lines to /etc/sudoers

%admins ALL =  <Full path to command 1>, <Full path to command 2>
5

How to encrypt your /home folder:

Before doing any of this, you should ensure you have a backup of your home directory and important files.

install the encryption utilities:

Open a terminal,

Press Ctrl+Alt+T

Run it:

sudo apt-get update
sudo apt-get install ecryptfs-utils cryptsetup

You’ll have to encrypt your home directory while you’re not logged in. You’ll need another user account with administrator privileges

You create one from Ubuntu’s User Accounts window:

Press your name on the panel and select User Accounts.

Create a new user account and make it an administrator.

Set a password by pressing the password box.

After creating the user account, log out of your desktop.

Select your new user account on the login screen and log in with it.

Open a terminal,

Press Ctrl+Alt+T

Run it, replacing user with the name of your user account:

sudo ecryptfs-migrate-home -u user

You’ll have to provide your user account’s password. After you do, your home directory will be encrypted.

Log out and log back in as your original user account.

Do not reboot your system before logging back in!

After you log in, press the Run this action now button to create a recovery passphrase.

Keep this passphrase somewhere safe – you’ll need it if you have to manually recover your files in the future.

You can run the ecryptfs-unwrap-passphrase command to view this passphrase at any time.

After restarting your system once or twice and verifying everything works properly, you can delete the user account and remove the backup home folder.

  • 1
    It will work only if you are logged out. If you are logged in, the directory is mounted and can be seen with sudo. – Serpens Jun 29 '15 at 12:18
  • And if the other user is determined enough, he can get your encryption passphrase from RAM. – Serpens Jun 29 '15 at 12:27
  • too complicated and risky – Tulains Córdova Jun 29 '15 at 15:48
  • @user1598390: Yes, it is true, but asked KVK: How can I encrypt my home ? – kyodake Jun 29 '15 at 23:36
3

You can easily change the permissions for your home directory to protect your private files. To check the permissions on your home directory, press Ctrl + Alt + T to open a Terminal window. Type the following line at the prompt and press Enter. Replace <username> (aka lori) with your own username.

ls –ld /home/lori

At the beginning of the line, the permissions for the file are listed.

“The r stands for “read,” the w stands for “write,” and the x stands   for “execute.” Directories will start with a “d” instead of a “-“. You’ll also notice that there are 10 spaces which hold value. You can ignore the first, and then there are 3 sets of 3. The first set is for the owner, the second set is for the group, and the last set is for the world.”

So, the home directory listed below has read, write, and execute permissions for the owner and read and execute permission for the group and world.

enter image description here

To change these permissions, type the following line at the prompt and press Enter.

sudo chmod 0750 /home/lori

Type your password when prompted and press Enter.

enter image description here

Press the up arrow twice to use the ls –ld /home/<username> command again to check the permissions. Notice that the permissions for world are all dashes (-). That means that the world cannot read, write, or execute anything in your home directory.

However, users in the same group as you can read and execute files and folders in your home directory. If you don’t want anyone else but yourself to have access to your home directory, enter 0700 as the numbers in the chmod command.

To close the terminal window, type exit at the prompt and press Enter.

enter image description here

Now, when other users on the system try to access your home directory, the following dialog box displays.

enter image description here

You can also set up Ubuntu to use specific permissions when setting up the home directory for a new user you are creating. To do this, you need to edit the adduser configuration file. To do this, type the following command at the prompt and press Enter.

gksudo gedit /etc/adduser.conf

enter image description here

Enter your password in the Password edit box on the dialog box that displays and press Enter or click OK.

enter image description here

Scroll down to the DIR_MODE command in the adduser.conf file. The number set is 0755 by default. Change it to reflect the different types of permissions (r, w, x) you want to grant to the different types of users (owner, group, world), such as 0750 or 0700 as discussed earlier. Click Save.

enter image description here

Close gedit by selecting Quit from the File menu. You can also click the X button in the upper-left corner of the window to close gedit.

enter image description here

Close the Terminal window by clicking the X in the upper-left corner of the window.

enter image description here

Now, the files in your home directory will remain private. Just remember that, if there are other users in the same group as you, you might want to take away the permissions for both group and world for your home directory.


Taken from (where other articles are referenced as well): http://www.howtogeek.com/190084/how-to-prevent-other-users-from-accessing-your-home-directory-in-ubuntu-14.04/

  • 1
    i tried this previous but if other user also know about sudo chmod 0755 \home \user1 command then it was no use – KVK Jun 29 '15 at 10:21
  • Other approach would be encrypting your /home directory! Which I recommend... – RiddleMeThis Jun 29 '15 at 10:23
  • how can i encrypt my home – KVK Jun 29 '15 at 10:25
  • @KVK you have to do that when you install i believe – Tim Jun 29 '15 at 10:28
  • @Tim it's doable after installation, but /home partition needs to be formatted during process. – RiddleMeThis Jun 29 '15 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.