I need to restrict the permissions of user directories in
/home so that, for some accounts, other users can not read files or cd in to them. But I still need to give system services access to them.
The approach I have been using until now is to
chgrp www-data the home directory and
chmod o-rx them, so they look like this
drwxr-x--- user www-data user
But I have just discovered that if the user created a
~/.forward file, postfix ignores it and delivers the mail locally. If I
chmod o+rx the directory,
.forward works again. (So this would seem to suggest, contrary to this answer, that either
.forward is read before postfix's local delivery agent is given the mail, or the local deliver agent isn't accessing the home directory as the user.)
How should I get around this? What if there are other system services that need access?
Another approach might be to
chgrp some-system-group the directory and make sure that any system services that access the directory are in the
Would this work? Is it a bad plan?
Are there any other approaches that are better?