Web Hosting Talk







View Full Version : CHMOD 0711 /home/user


vanHelsing
07-28-2004, 05:18 AM
1 of my user were complaining that all of he´s files are accessible by all other shell users and that they can download all files etc. I was trying to find an solution to this, wondered about jailedshell, ftp access only in homedir with proftps etc.

Then i got it, CHMOD 0711 /home/user dir. Now nowone cant list that user dir anymore, other than root and owner! They just got error message: "Error listing directory".

Now, is it possible to CHMOD "something" the very root of the server, that no one cant list my server files? Can i do same to /home dir, does this effect anyhow to users?

sprintserve
07-28-2004, 05:48 AM
No. If you do it to your root directory, a lot of programs will have problems running.

vanHelsing
07-28-2004, 06:11 AM
Ah ok, whatabout if i manually chmod all roots subdirs and take off that "default - read". Like this:

Now: /bin is 755
New chmod to: /bin 711

And then do the same to /etc /boot /usr /var etc.
Does this mess up the system also?

If this works then they cant see any system files, right?

Bashar
07-28-2004, 06:31 AM
/etc is a VERY BAD IDEA it has the shadow file and password file

some stuff like /usr wont be effected or /var, but why you wanna do that? these are the default files on all servers, so no use of hiding them, knowing the location of the file wont change anything.

vanHelsing
07-28-2004, 06:39 AM
OK. I just did:

CHMOD /home 0771
CHMOD /home/allusers 0711
And some backup and temp folders.

Seems to work fine, and this was what i were looking for.
Thx Bashar and sprintserve.

Bashar
07-28-2004, 08:28 AM
yeah thats fine :)

btw 0711 = 711

here is an article i wrote few years back :D
http://www.defcon1.org/html/Software_Articles/Learning-CHMOD/learning-chmod.html

sprintserve
07-28-2004, 08:32 AM
The first bit is a sticky bit. With it on, it's more secure as only the file owner and the superuser (read as root) can delete the file.

lwknet
07-28-2004, 10:02 PM
i've been doing this for more than a year