Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I like to fix permissions on our fileserver via cron. In general I like to set everything to umask 027 ignoring any changes a user did. For certain subfolders I like to apply umask 077.

The question is not about how to set and use umask, but correct repeatedly the permission via cronjob in case the user changed something.

eg in the end it should look like

drwx------ /home/user/.ssh
drwxr-x--- /hom/user/foobar
drwx------ /hom/user/Mail

The hard way (which I want to avaoid) looks like this:

chmod -R o-rwx /home/user  
chmod -R g+r /home/user  
find /home/user -typer d -exec chmod g+x '{}' \;  
chmod go-rwx /home/user/{Mail,.ssh}
share|improve this question
up vote 1 down vote accepted

Here's what we use for something similar (for all folders not owned by root). The seemingly unnecessary find commands are to ensure that we don't set permissions on any folder that was already set correctly. An earlier script that blindly chmod-ed all folders would cause some of my backups to think files had changed mid-backup, and I wasted a ton of media backing up the same files every day.

The resulting permission set:

  • Home directories are mode 711 to prevent casual browsing, but still allow Apache to see into the user's public_html folder
  • public_html is mode 755, as are all folders inside public_html except for a top-level private folder we use to store things that would otherwise be giant email attachments
  • all files in public_html are mode 644


cd /home/CAE
# For all directories except those owned by root
for user in `ls -l | grep -v ' root ' | egrep '^d' | awk '{print $NF}'`; do
    cd /home/CAE
    # Fix top-level permissions to avoid people browsing accounts, but
    # to allow normal Web access to public_html
    find . -mindepth 1 -maxdepth 1 -name ${user} -type d ! -perm 0711 -print0 |    xargs -r -0 chmod 711

    # Make sure user has a Web directory (and a private one, also)
    if [ ! -d ${user}/public_html/private ]; then
        mkdir -p ${user}/public_html/private
        chown -R ${user}:users ${user}/public_html

    cd ${user}/public_html

    # Set top-level private folder to mode 711 if it isn't already
    find . -mindepth 1 -maxdepth 1 -name private -type d ! -perm 0711 -print0 | xargs -r -0 chmod 711

    # Set all directories except top-level private to mode 755 that aren't already
    find . -maxdepth 1 -type d ! -name private ! -perm 0755 -print0 | xargs -r -0 chmod 755
    find . -mindepth 2 -type d ! -perm 0755 -print0 | xargs -r -0 chmod 755

    # Set all files mode 644 that aren't already
    find . -type f ! -perm 0644 -print0 | xargs -r -0 chmod 644

share|improve this answer
Thanks, I adopted some parts of your script the checking for permission instead of direct forcing chmod on everything speeds up the whole process. – Justin Sep 12 '11 at 19:31

Forgive me if I'm missing the point, but it looks like you want a crontab entry that runs the following commands fairly frequently:

chmod -R go-rwx /home/user/.ssh
chmod -R g-w /home/user/foobar
chmod -R o-rwx /home/user/foobar
chmod -R go-rwx /home/user/Mail

or was that not what you were asking how to do?

share|improve this answer
I want to recursivaly change the permission except for a couple of dirs: chmod -R g+r /home/user && find /home/user -type d -exec chmod g+x '{}' \; && chmod -R go-rwx /home/user/{Privat,.ssh,Mail}. But this would lead to changing the permissions twice for some directories. – Justin Sep 12 '11 at 14:21

You can mount the partition with acl support, and use the getfacl & setfacl commands to make & restore backups.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.