0

i know that it is probably very simple, but i looked in the internet and didnt find

i want to set a password on a folder (so that only whoever knows the password can enter) in Linux using only a shell command. does anyone know how can i do that?

3 Answers 3

2

The real answer is that using a password to protect a folder does not work. Standard Unix permissions or extended permissions do provide some reasonable level of protection though. You are asking about a specific solution to an unspecified problem. I believe you have one of two problems:

  1. You want to keep other users on a system out of a folder
  2. You want to keep everybody, anywhere, anytime, out of a folder without permission

In situation #1, you have Unix permissions via the chmod(1) command available to you. You also have some advanced tricks with the setfacl(1) and getfacl(1) commands. Note that "the password" you desire is tied to the account doing the access. If your are concerned that there are too many ways for someone to use an account (e.g. ssh, X11, console, serial, ftp, Subversion), then learn about the complex world of PAM (Pluggable Authentication Modules) and restrict their options. If you think passwords used will be too weak (e.g. "password123") then PAM can enforce complexity and length on passwords. In short though, make the authentication for accessing the folder come through the operating system user authentication method. This provides the best accounting, restricting, and upgradable path.

To demonstrate the setfacl and getfacl commands, consider three users, "u1," "u2," and "u3." We are looking at folder "/f" owned by "u1." "u1" will grant access only to "u2," leaving "u3" out.

u1%  umask 700; mkdir /f; setfacl -m user:u2:rwx /f
u1%  getfacl /f
   user::rwx
   user:u2:rwx    <-- access granted 
   group::---     <-- anyone in the same group is still denied
   mask::rwx
   other::---     <-- everybody else is locked out too

In situation #2, you have a malicious attacker who can access any part of the hard drive any time they want. You will have to use encryption and a loopback device to enforce this. I will not cover that topic here as it is fairly complicated. Some distributions (Ubuntu?) allows for home directories to be encrypted.

Password protecting a file does no good if there isn't a way to prompt the user for the password or if mounting the filesystem on another system gets around the password requirement. This is why encrypted thumbdrives have a tough time working in Linux - they use Windows-specific software to collect the password require to decrypt the device.

= zerolagtime

1
  • In my experience external encrypted devices work great on Linux if you use luks and pmount.
    – Zoredache
    Sep 27, 2010 at 20:16
0

Generally you do this with group permissions instead. You create a group, add users to that group that you want to be able to see those files, and then only give users and group permission to read the file i.e.

chmod 640 file.txt

Update:

To add a group (as root) use the "groupadd" command

# groupadd mygroupname

Delete:

# groupdel mygroupname

Adding / removing people to/from the group:

# usermod -G mygroupname userNameToAdd

Note, this requires you to be the system owner. If you want to do this specifically as a user on the system, you're almost better off adding files to an archive and passwording that or encrypting files and sharing a key.

As embobo has said in their comment, you can use gpasswd to essentially create group administrator(s) whom can add/remove people from a group, check the man page on that one.

2
  • thanx but how do add people to the group, and how do i cancel the group?
    – user55435
    Sep 27, 2010 at 18:04
  • Too add run: gpasswd -a <user> <group> and to delete run: gpasswd -d <user> <group>. Sep 27, 2010 at 18:42
0

An alternative approach would be to zip the directory and remove the unencrypted files using this command

zip -e protected.zip directory/ && rm -rf directory/

You will be prompted (twice) to enter a password.

You can "unlock" the folder again by unzipping it.

See man zip and man unzip if this looks it may be a solution

You must log in to answer this question.