Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to restrict the permissions of user directories in /home so that, for some accounts, other users can not read files or cd in to them. But I still need to give system services access to them.

The approach I have been using until now is to chgrp www-data the home directory and chmod o-rx them, so they look like this

drwxr-x--- user www-data    user

But I have just discovered that if the user created a ~/.forward file, postfix ignores it and delivers the mail locally. If I chmod o+rx the directory, .forward works again. (So this would seem to suggest, contrary to this answer, that either .forward is read before postfix's local delivery agent is given the mail, or the local deliver agent isn't accessing the home directory as the user.)

How should I get around this? What if there are other system services that need access?

Another approach might be to chgrp some-system-group the directory and make sure that any system services that access the directory are in the some-system-group group.

Would this work? Is it a bad plan?

Are there any other approaches that are better?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

With classic unix permissions, you will end up with problems. Things you can try:

  • Use ACLs instead, if supported. This way, you can give eg. the wwww-data group separate permissions.
  • If that's not going to work, you have to try to prevent the requirement for home dir access:
    • Instead of classic ~/.forward, maybe try to use sieve filtering or other deliver methods.
    • For the WWW stuff, you can alter the webserver config to use an alternative directory where all user web dirs are stored and then symlink into it from the real home directory. That is if you really want ~/username websites, which I tend to disable everywhere these days.
share|improve this answer

As documented, with a default configuration postfix assumes the identity of the mailbox owner before attempting delivery.

Specifically:

Delivery via ~/.forward files is done with the privileges of the recipient. Thus, ~/.forward like files must be readable by the recipient, and their parent directory needs to have "execute" permission for the recipient.

If this isn't working for you, you messed up the permissions somehow.

share|improve this answer
    
Do you know what, you're right. The user directories were actually owned by root! Doh! Thanks for that. :o) I'd love to give you a tick, but I think the general question still stands. I'm interested in a way of granting other system services in general access to user home directories. –  edam Jan 8 '13 at 12:16
    
ACLs are your best bet then. –  adaptr Jan 8 '13 at 12:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.