I want to make my ubuntu 12.04 server a little more secure. Actually I would like to have paranoid security as of file permissions and a usable system as well. (this is my main goal)

For starters I would like to change the default permissions under the / folder. These permissions are by default set to 755 for most folders (rwxr-xr-x). I would like to change them to 751. Do you think this might cause a problem? If so why would it? Does the OS need read permissions for others?

I can understand that a user (like www-data) should be able to cd in a directory but why does he need to be able to read its contents if it is provided with the full path? I searched for a resource of strict file permissions but all I can find is acls. I would like to try the other approach first.

  • These days people tend to use containers (lxc), jails, or virtual machines to protect the base OS against the users. Nany applications assume they have read access too many places. You will almost certainly cause far more problems then you fix trying to go against the distro defaults. – Zoredache Mar 20 '13 at 16:31

Setting directories ACLs to 0751 will actually be a problem more for you than for the system. For others (the 1) a directory listing becomes prohibited, so the browse operation is not possible. The system knows usually what to find and where to find it (and also should keep access via the user or group acl).

Be sure to change the ACL via

chmod o-rw directory

since chmod 751 directory may be dangerous (as you may remove su, sticky bits ...). I would advise you to check every dir before to proceed anyway.

If you google for ubuntu paranoid accesses you will see interesting pages in this regard, as setting many dirs to 0751 is something I wouldn't be doing/trying..

  • Thank you! I didn'y know that there was a difference between chmod 0-rw and chmod 751! – ioctl Mar 20 '13 at 18:01
  • chmod o-rw it's a o (as in overflow), not a zero... – Breaking not so bad Mar 21 '13 at 6:12
  • hehe! yes o as others. – ioctl Mar 21 '13 at 14:59

If this were necessary, or sane, the Ubuntu developers would have done it long ago. Generally, the permissions are correct by default and reasonably secure. The exception to this is would be utilities with setuid. They can be considered a risk and you may wish to remove this mode.

Since most files are owned root:root, in order for you to execute standard binaries which link to shared libraries the others bit is necessary.

For more information, check out Chapter 7 of the CIS Benchmark for Debian Linux.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.