13

I have accidentally changed /home's permissions to 777.

What permissions should this directory have ?

1
  • I spent way too much time thinking this question was about a user's home directory, not THE /home directory. Jul 17, 2022 at 14:26

7 Answers 7

16

I think the best permission would be

 711 if you dont want to add groups as well or

 751  so that public can't read your home directory

with 755 public can read which other users are on you home directory

5
  • 4
    Multiple of these answers allow group read in "/home". This strikes me as utterly lacking in privacy terms. If you're in a group environment, you likely have a group share some place. THAT is where shared files belong. IMO, 701 is the best permission set for /home.
    – Jeter-work
    Nov 5, 2016 at 17:57
  • @Xalorous Members of the root group are allowed to read in the home directory. That shouldn't be a problem?
    – frodeborli
    Aug 2, 2017 at 13:33
  • 1
    I'm not referring to the root group, and I meant to refer to folders within /home. Of course, if it's a single user system, there's no harm in setting the user's home to 755. 755 seems to be the default (RHEL 7). However, if security is important, it's key to remove read and write for group and other.
    – Jeter-work
    Aug 2, 2017 at 22:04
  • @Xalorous In almost every system I have seen, the home folders are owned by the user and his primary group. So it would not matter if the permissions of the home folder were even 770. Access to the folder would only be to members of the users primary group. Other users would still not be able to access the folders. I use 750 on users home directory.
    – frodeborli
    Aug 17, 2017 at 19:41
  • 1
    I use primary group to allow access to shared folders, and users' home folders are 700. This allows security and sharing of folders using primary groups. On network where each account has a group with the same name as user name, 770 is the same. But, it makes sharing without using the 'other' bit difficult. Allowing 'other' access means anyone with access to the system can read from there (confidentiality compromised), and if writable as well, it increases security concerns exponentially (integrity and availability are compromised, AND folder can be used by malware/intruders for staging.)
    – Jeter-work
    Aug 17, 2017 at 21:51
8

Between 751 and 750, it should be noted that 751 can be used to allow access to a subdirectory of your home directory.

One place you might use this is when enabling the Userdir mod for the Apache web server -- it allows you to give each user their own web-browseable directory, under a common name such as public_html. For example, a URL like http://<hostname>/~<username> can be automatically served up from /home/<username>/public_html/. But to do that, Apache needs to have sufficient permissions within your home directory to at least read files in a folder under it.

Setting a directory to 751 allows it to be navigated to (by anyone) without being read. This, in turn, is required to allow the username that Apache runs under to get 'through' your home directory to the public_html within it.

This is useful, in my experience, primarily for web development on a local machine, though I've seen it in action not uncommonly with educational institutions.

1
  • 750 does not work on /home. Users will not be able to access their own home folder, due to not being able to access /home first. 751 works fine.
    – frodeborli
    Aug 17, 2017 at 19:44
2

The default would usually be 0755.

I guess 0751 would also work, if you for some reason don't want the content to be publicly browsable.

(of course, owned by root:root)

3
  • But i have websites for public view in user accounts
    – Mirage
    Dec 8, 2009 at 23:47
  • Yes, and you can have different ownership settings on folders further down in the tree. The only thing which is import at this level is that "others" (value to the far right) at least has the X-bit (1), allowing anyone to traverse further down to the publicly browsable folders, which then also would be to be readable.
    – andol
    Dec 9, 2009 at 0:21
  • @OooooO that sounds like a nightmare to secure, backup, or restore. 100% manual operation. If you keep the users' profiles private, and separate anything shared into a shared location, you can treat each section as it needs to be treated. As it is, you have private files mixed with shared ones.
    – Jeter-work
    Nov 5, 2016 at 17:59
1

Rather than set executable on every file (which includes lots of non-executable files) in your home folder (something that you have to manually undo), and wiping some of the existing permissions you already had, it is preferred to take an additive/subtractive approach instead with permissions.

I never recommend one octal for every file. Files have permissions for a reason. Sometimes you want to disable an executable. Maybe something that could damage your system is marked as executable. chmod ug+x <file> will add execute permissions to specific files in your home folder instead.

Follow these instructions for more secure and traditional file permissions (similar to the idea behind chmod 751 rwx r-x --x but without global executable permissions or removing existing permissions for the user).

  1. Set the owner as the user, and set the group to the user group (substitute your user name):

    sudo chown -R <username>:<username> ~

  2. Make sure we have read and write access to all files from "user":

    chmod -R u+rw ~

  3. Remove write access from "group":

    chmod -R g-w ~

  4. Remove all access from "others":

    chmod -R o-rwx ~

  5. Make sure all directories are executable (they must be to enter into them):

    find ~ -type d -name \* -exec chmod +x {} \;

  6. Remove all access to your .ssh private keys except for the user (if you have a ~/.ssh folder):

    chmod -R go-rwx ~/.ssh

Hope that helps.

0

I would say 0755 is your best bet.

1
  • 1
    This sounds more like a rumor than an answer. Can you explain why you feel differently than the accepted answer?
    – chicks
    Feb 27, 2018 at 14:32
0

the /home directory should be 755 IMO. I use 755 or 750 on each user's /home/username directory for more privacy.

0

755 for /home

770 for individual user home folders or folder where you want to give write privileges to your group. In most cases, I set the last digits to 0 because if they are not in my group, I usualy dont want them to have any access at all.

I use 770. this way, people not in my group have no access whatsoever to the subfolders. With 775, people can still see your directory structure and names.

2
  • I would not recommend group write permission for a personal home directory. Maybe a shared service "drop box" for a pseudo-user's home dir, but there are better ways to implement that.
    – kmarsh
    Jan 15, 2014 at 22:33
  • Agree about not having write for anyone but owner in the home tree.
    – Jeter-work
    Nov 5, 2016 at 17:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .