Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can I run chmod o=- -R / ?

I don't want a newly created user to be able to cat /etc/passwd, just because of its default permissions. And I want to understand why these defaults were chosen for permissions on all (well most) system files as well as for other files.

share|improve this question
    
thanks for the answers, /etc/passwd was just an example to illustrate the issue. we were just looking for an appArmor, grSecurity kind of solution without using any. now we know that we have to. –  Devrim Sep 14 '09 at 23:59
add comment

4 Answers

up vote 10 down vote accepted

Because many programs might need access to those files. As an example, whenever you do an 'ls -l', the system will look up /etc/passwd to translate between numerical uid and the username. This wouldn't work if the user didn't have any rights to read that file.

Even more important, if you would take the read rights for every file, you couldn't even login anymore, because you were not allowed to read the shell binary.

share|improve this answer
add comment

Why not leave system files readable?

  • Obscurity is not security

    Your system should be just as secure even if people know how it works. If you're relying on details being kept secret to keep your system secure it's just a matter of time before it's broken.

  • How will you work?

    It is generally accepted that you should use the root account as little as possible. If you have to use the root account for the most basic of tasks you'll end up just using it all the time.

  • System functionality

    In many cases the system can't function if certain important conf files can't be read by non root users, as others have illustrated with the /etc/passwd example.

can i do chmod o=- -R / ?

Not if you want to actually be able to login and use the system. Nothing's perfect, but for the most part most distributions have relatively sensible default permissions in most cases. Some of these may need to be changed depending on your circumstances, but it should be discussed on a file by file basis, where the affects of changing the file permissions are known.

share|improve this answer
    
I loved your answer. It would be ideal without the tone. "Obscurity is not security": We weren't aiming at just hiding files, this question with it's answer was going to solve the riddle, as such, it didn't nonetheless. –  Devrim Sep 15 '09 at 0:06
add comment

password file is readable for use by a number of standard utility programs, this is why exists the /etc/shadow file, that is instead not readable by normal users and actually stores encrypted password.

NOTE: Passwords are stored in a non-readable file (/etc/shadow) even if encrypted, in order to avoid brute force attacks by local users.

share|improve this answer
add comment

The ls command and many others use the /etc/password file to convert user IDs to user names. Don't change it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.