2

In my debian all files, even the system ones have permissions rw-r--r--, so it means that all users can view ANY file even some system configuration or database files and so on.

How do I prevent users from reading all system files ? Is there any way how to set global permissions so users cannot read all the files ?

1

3 Answers 3

3

I don't think that denying access to all system files for all users is a good idea. Some of those files are necessary to work in a system. But there are several ways to restrict specific users. For example, if you wanted to deny user joe access to anything in /etc, you could use ACLs (manipulated with setfacl/getfacl commands), like this:

setfacl -Rm u:joe:--- /etc

Other ideas would be to use selinux policy, or keep users in chroot. I think chmod 700 on system directories is a bad idea, because it will deny access to various system users like nobody, ftp or mail, which are used by some system services.

7

In my debian all files, even the system ones have permissions rw-r--r--, so it means that all users can view ANY file even some system configuration or database files and so on.

Unless you fiddled the permissions, they are absolutely fine as they are out of the box. Please do not change them, especially not in that circumference.

System (configuration) files are meant and save to be read by everyone. In certain cases they must be readable (/etc/bash.bashrc or /etc/default) and on other cases they are already protected (/etc/shadow).

Database files, that in Debian reside in /var/lib are also protected.

drwx------ 10 mysql   mysql   4.0K Feb 26 12:49 /var/lib/mysql

You can assume that for most software from the Debian repositories the permissions are safe as they are. There are exceptions of course. Web hosting is one of them, where you usually have to make bigger permission-adjustments to the document root and PHP-FPM socket files.

If you do not absolutely know what implications a change of the permissions on the 'default' folders have, you should decide against it.

The only place where the default permissions are indeed too liberal is within the /homedirectory, at least in my opinion.

0

An interesting aspect of Linux permissions is that the default permission is typically 777 (-rwxrwxrwx) and then umask is used to automatically remove permissions, so that when new directories or files are created, the newly created directory or file is not 777, and instead is something like 644 (-rw-r--r--) or 666 (-rw-rw-rw-). If you wish to remove the default read permission for all files/directories, you can adjust the umask. However, changing umask is probably not the solution to the task you face.

I think the solution would be to control access using chmod and chown or setfacl and getfacl. For example, lets say only root should have access to /var/private. You could use the following commands so that only root can read, write and access the directory and files in the directory.

Set root as both the owner and group owner of /var/private:

chown -R root:root /var/private

You could also set the permission on the directory so that only root can access the directory (-rwx------):

chmod 0700 /var/private

You could then recursively set the permission on all files in the directory so that only root can read, write and execute files in the directory (-rwx-----):

chmod 0700 -R /var/private/* 

Note: I do not know how you are using your database. If your database files are accessible from a Web browser, such as through PHP or ASP.Net, this permission change may prevent PHP or ASP.Net from being able to interact with database records.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .