Linux -- system wide readable folders

vash

Platinum Member
Feb 13, 2001
2,510
0
0
Alrite, by default, I installed Debian allowing users to view other users' home directories. How/where do I change it so that all users can view only their home directory (and their sub folders)?

vash
 

rmrf

Platinum Member
May 14, 2003
2,872
0
0
make sure that the directory only allows read/write/execute access to the owner of the folder. to do this, type this command as root in the /home directory:

chmod -R 700 <foldername>

then make sure that each of the folders are owned by the user that needs access, and that the group is set for that user also. this will take two commands:

chown -R <username> <foldername>
chgrp -R <groupname> <foldername>

hope this helps. I would like to hear back if it does work for sure, I didn't test this on a debian system.
 

vash

Platinum Member
Feb 13, 2001
2,510
0
0
chmod 700 was the key, thanks! Now users cannot see other users' files. Someday I'll reinstall my Debian box, using the security docs, line by line.

vash
 

chsh1ca

Golden Member
Feb 17, 2003
1,179
0
0
The group step is unneeded if you are chowning to the user itself.

chown <user> /home/<user>
chmod 0700 /home/*

should be all you need to do. Keep in mind root will still be able to access the directories.
 

vash

Platinum Member
Feb 13, 2001
2,510
0
0
Alrite, I'm very poor at calculating unix permissions. Thank you for help!

What value should I set so that specified folders are readable and writeable to a number of different groups? I have a few samba folders I would like groups to view, copy and execute (run installers) files from, but don't want anyone to write in there, except for _one_ person (well, root as well, but just one person otherwise).

Thanks again!
vash
 

chsh1ca

Golden Member
Feb 17, 2003
1,179
0
0
The concept behind unix groups is that you create one group per specific task you want to assign. So for instance, let's say you have a directory in /usr/fileshare or something, that you would like an entire group to have read/write access to. You simply add a group to the effect of 'smbfshare' or something, and then add the appropriate users to the group.
Then, pick one person to own the files, and then chown it <owner>:<group>, and all files in it to 0640, and all dirs to 0750. Owner in this case would be the person you need to have rw access, and everyone else is just in the 'smbfshare' group (or whatever you called it).

This is the basic premise behind the entire user/group system, and is a very nice keep it simple approach.
 

Drift3r

Guest
Jun 3, 2003
3,572
0
0
Originally posted by: chsh1ca
The group step is unneeded if you are chowning to the user itself.

chown <user> /home/<user>
chmod 0700 /home/*

should be all you need to do. Keep in mind root will still be able to access the directories.


shouldn't you stick -R in the chmod command ? Especially if he already has sub-folders.
 

Nothinman

Elite Member
Sep 14, 2001
30,672
0
0
Don't worry about the numbers, use the symbols instead. To remove execute for the group and 'other' permissions on a directory do 'chmod g-x,o-x /directory' to add write access to the group on a directory do 'chmod g+w /directory'.

That Debian question just determins the rights on the /home directory itself anyway, whether other has r-x or nothing.
 

rmrf

Platinum Member
May 14, 2003
2,872
0
0
Originally posted by: Drift3r
Originally posted by: chsh1ca
The group step is unneeded if you are chowning to the user itself.

chown <user> /home/<user>
chmod 0700 /home/*

should be all you need to do. Keep in mind root will still be able to access the directories.


shouldn't you stick -R in the chmod command ? Especially if he already has sub-folders.

Definitely. the subfolders will still have the same permissions, and the user will not be able to access the existing files. The chgrp command is necessary so that the /home directory conforms to the standards of what the /home directory is supposed to be. if any users need access to those files in someone else's folders, they can be added to the group, and the chmod command should be used again so that the group ownership at least has read permission, and depending on the what the administrator wants or the user needs, the files can be writable and executable.
 

vash

Platinum Member
Feb 13, 2001
2,510
0
0
Would it be bad if I just ran the chmod 0700 -R from root? I'm thinking I'll run into lots of problems if I did that, so I'm throwing that out there.

Thanks again for the help!

vash
 

Nothinman

Elite Member
Sep 14, 2001
30,672
0
0
From /? That would mean no regular users could do anything because they wouldn't be able to read any executables to run them.
 

vash

Platinum Member
Feb 13, 2001
2,510
0
0
Ok, now I'm stuck. The help so far has been great and I'm getting more familiar with chmod (not using the binary method yet).

Here is what I've done:
1. Setup a user and group named samba. I've added myself to a member of the samba group.
2. In /, root:root owns a directory named "samba" .
3. In the /samba folder, there are multiple subdirs and I've ran the following:
chmod -R u=rx
chmod -R g=rwx
chmod -R o=rx

I want all members of the group "samba" to be able to read/write/execute, while any other person just to be able to read.

When I connect with myself (via samba), I can view all the directories, but am never able to write to the main folder, but I am able to write in the sub folders (but I cannot delete). I'm sure this is an easy fix for anyone here, but some help is greatly appreciated.

vash
 

drag

Elite Member
Jul 4, 2002
8,708
0
0
If I had a box that was going to samba only then I'd just make a user just for that purpose. If I needed to do some samba work I'd just "su sambadmin" or whatever.

And don't forget that samba doesn't follow the traditional method of users and such. It has it's own set of rules and it's own set of users that you use when you connect using samba.... Usually you can make duplicates of users in the samba config, but those are samba specific and not unix, unless you do something fancy with the PAM stuff. It's kinda like windows were you have the local users and the samba users. If you set rights for one set of users, it doesn't always affect the other group. I am not to familar with samba to tell you anything beyond that. Check out the Samba config file and other documentation.


Other things you may want to look into when dealing with unix style file permissions is a command called umask.

Using this you can set the default file permissions that are used everytime you create a new file or folder....


Also the number stuff isn't that hard to figure out, you said it your self:
read/write/execute(also "search" for directories)

they corrispond to binary numbers
000
421
read/write/execute.

so when it's translated to decimal numbers
7 = read/write/execute
5 = read/execute
3 = write/execute
6 = read/write
4 = read only
etc etc....

then you have 3 groups of users:
owner/group members/everyone else.
in that order..
So when I do a "ls -ld poo" I get

drwxr-xr-x 3 drag users 19 jul 4 04:12 poo

the d means its a directory, the first set of rwx means that the owner (drag) has full rights to this directory, the second set is for people who belong in the group "users"; they can read or search thru this directory, but don't have the right to modify it. Ditto for the last set which is for everybody else.

But what if I don't like that? I want bob be the owner and allow his study group "lusers" full access to it, but deny everyone else from it.
So as root I:

chown bob:lusers poo
chmod 770 poo

and that's it.

Don't forget of course that a directory is just a file that points to other files or "hard links" that themselves point information on the harddisk. So if you give someone write access that means that they can delete or create new files. HOWEVER they can still access those files inside the directory and modify them, since the permissions only apply to the directory "files" themselves. The files themselves still have their own ownership properties. So if someone has rights to a file inside a directory, but have only "x" or search access to them, they can modify the file, just not delete it completely or create new files. Even if you get rid of the read and write rights for that class of users, then can still access those files inside it.

It's a bit confusing at first, but once you realise that the directory itself is just a special sort of file and not a actual physical contaner it begins to make sense. Play around with different file/directory permissions and see what happens.

Here is what I do. make directory "poo" in your home folder. Inside your poo folder run the command "touch crap log floater" to quickly create 3 files. Now go back down to your home folder and become root. Change the owner of the poo directory to root, buy leave the group the same as your normal user. Now play around with permissions. Run like a "chmod 766 poo" then just "su" to your username and try to change one of the files, or "ls -l poo" and do stuff like that. It's kinda interesting what sort of things happen when your rights to the folder change, but you still own the files inside. And don't forget that if you just "ls -l poo" your going to be viewing poo's contents. You must "ls -ld poo" to examine directories directly.

To fully understand file permissions is a bit tricky because your playing on the fine line of abstraction that devides the happy freindly world of files and directory relationships and are beginnning to get into the real meat of how the actual programming works and how software interacts with hardware and all that fun stuff that is normally hidden from you.

But also keep in mind that Samba has it's own set of users and groups that are completely independent from your normal unix users and groups. I don't like it, but it does make it easier to provide windows user support.

 

Nothinman

Elite Member
Sep 14, 2001
30,672
0
0
And don't forget that samba doesn't follow the traditional method of users and such. It has it's own set of rules and it's own set of users that you use when you connect using samba.... Usually you can make duplicates of users in the samba config, but those are samba specific and not unix, unless you do something fancy with the PAM stuff. It's kinda like windows were you have the local users and the samba users. If you set rights for one set of users, it doesn't always affect the other group. I am not to familar with samba to tell you anything beyond that. Check out the Samba config file and other documentation.

Not really. Samba uses the same local users as anything else, it's only the passwords that must be kept seperate because the NTLM encryption isn't the same as crypt or MD5 used on Linux or whatever encryption is used on another unix. You can setup winbindd to skip the use of non-unix accounts, but then the UIDs are gotten via nsswitch from the NT domain and they're techincally valid UIDs for anything, including file permissions.
 

chsh1ca

Golden Member
Feb 17, 2003
1,179
0
0
Originally posted by: Drift3r

shouldn't you stick -R in the chmod command ? Especially if he already has sub-folders.

Only if that's what you want to do. Nothing about the poster's original post mentioned anything about subdirectories and whatnot. I wasn't going to assume that all the directories should be toyed with, and figured that people would be intelligent enough to figure out that recursion needed to be done separately since it is done separately everywhere else. Possibly a silly assumption on my part, but I wouldn't want someone using -R when it was unneeded.

In fact, using -R in general is a bad idea unless you KNOW what is under the directories you are screwing with. Assuming that, it is safe to assume someone will know they need to figure out recursion is a separate flag, right?
 
sale-70-410-exam    | Exam-200-125-pdf    | we-sale-70-410-exam    | hot-sale-70-410-exam    | Latest-exam-700-603-Dumps    | Dumps-98-363-exams-date    | Certs-200-125-date    | Dumps-300-075-exams-date    | hot-sale-book-C8010-726-book    | Hot-Sale-200-310-Exam    | Exam-Description-200-310-dumps?    | hot-sale-book-200-125-book    | Latest-Updated-300-209-Exam    | Dumps-210-260-exams-date    | Download-200-125-Exam-PDF    | Exam-Description-300-101-dumps    | Certs-300-101-date    | Hot-Sale-300-075-Exam    | Latest-exam-200-125-Dumps    | Exam-Description-200-125-dumps    | Latest-Updated-300-075-Exam    | hot-sale-book-210-260-book    | Dumps-200-901-exams-date    | Certs-200-901-date    | Latest-exam-1Z0-062-Dumps    | Hot-Sale-1Z0-062-Exam    | Certs-CSSLP-date    | 100%-Pass-70-383-Exams    | Latest-JN0-360-real-exam-questions    | 100%-Pass-4A0-100-Real-Exam-Questions    | Dumps-300-135-exams-date    | Passed-200-105-Tech-Exams    | Latest-Updated-200-310-Exam    | Download-300-070-Exam-PDF    | Hot-Sale-JN0-360-Exam    | 100%-Pass-JN0-360-Exams    | 100%-Pass-JN0-360-Real-Exam-Questions    | Dumps-JN0-360-exams-date    | Exam-Description-1Z0-876-dumps    | Latest-exam-1Z0-876-Dumps    | Dumps-HPE0-Y53-exams-date    | 2017-Latest-HPE0-Y53-Exam    | 100%-Pass-HPE0-Y53-Real-Exam-Questions    | Pass-4A0-100-Exam    | Latest-4A0-100-Questions    | Dumps-98-365-exams-date    | 2017-Latest-98-365-Exam    | 100%-Pass-VCS-254-Exams    | 2017-Latest-VCS-273-Exam    | Dumps-200-355-exams-date    | 2017-Latest-300-320-Exam    | Pass-300-101-Exam    | 100%-Pass-300-115-Exams    |
http://www.portvapes.co.uk/    | http://www.portvapes.co.uk/    |