6

I have accidentally changed /home's permissions to 777.

What permissions should this directory have ?

10

I think the best permission would be

 711 if you dont want to add groups as well or

 751  so that public can't read your home directory

with 755 public can read which other users are on you home directory

  • 1
    Multiple of these answers allow group read in "/home". This strikes me as utterly lacking in privacy terms. If you're in a group environment, you likely have a group share some place. THAT is where shared files belong. IMO, 701 is the best permission set for /home. – Xalorous Nov 5 '16 at 17:57
  • @Xalorous Members of the root group are allowed to read in the home directory. That shouldn't be a problem? – frodeborli Aug 2 '17 at 13:33
  • I'm not referring to the root group, and I meant to refer to folders within /home. Of course, if it's a single user system, there's no harm in setting the user's home to 755. 755 seems to be the default (RHEL 7). However, if security is important, it's key to remove read and write for group and other. – Xalorous Aug 2 '17 at 22:04
  • @Xalorous In almost every system I have seen, the home folders are owned by the user and his primary group. So it would not matter if the permissions of the home folder were even 770. Access to the folder would only be to members of the users primary group. Other users would still not be able to access the folders. I use 750 on users home directory. – frodeborli Aug 17 '17 at 19:41
  • I use primary group to allow access to shared folders, and users' home folders are 700. This allows security and sharing of folders using primary groups. On network where each account has a group with the same name as user name, 770 is the same. But, it makes sharing without using the 'other' bit difficult. Allowing 'other' access means anyone with access to the system can read from there (confidentiality compromised), and if writable as well, it increases security concerns exponentially (integrity and availability are compromised, AND folder can be used by malware/intruders for staging.) – Xalorous Aug 17 '17 at 21:51
5

Between 751 and 750, it should be noted that 751 can be used to allow access to a subdirectory of your home directory.

One place you might use this is when enabling the Userdir mod for the Apache web server -- it allows you to give each user their own web-browseable directory, under a common name such as public_html. For example, a URL like http://<hostname>/~<username> can be automatically served up from /home/<username>/public_html/. But to do that, Apache needs to have sufficient permissions within your home directory to at least read files in a folder under it.

Setting a directory to 751 allows it to be navigated to (by anyone) without being read. This, in turn, is required to allow the username that Apache runs under to get 'through' your home directory to the public_html within it.

This is useful, in my experience, primarily for web development on a local machine, though I've seen it in action not uncommonly with educational institutions.

  • 750 does not work on /home. Users will not be able to access their own home folder, due to not being able to access /home first. 751 works fine. – frodeborli Aug 17 '17 at 19:44
2

The default would usually be 0755.

I guess 0751 would also work, if you for some reason don't want the content to be publicly browsable.

(of course, owned by root:root)

  • But i have websites for public view in user accounts – Mirage Dec 8 '09 at 23:47
  • Yes, and you can have different ownership settings on folders further down in the tree. The only thing which is import at this level is that "others" (value to the far right) at least has the X-bit (1), allowing anyone to traverse further down to the publicly browsable folders, which then also would be to be readable. – andol Dec 9 '09 at 0:21
  • @OooooO that sounds like a nightmare to secure, backup, or restore. 100% manual operation. If you keep the users' profiles private, and separate anything shared into a shared location, you can treat each section as it needs to be treated. As it is, you have private files mixed with shared ones. – Xalorous Nov 5 '16 at 17:59
0

I would say 0755 is your best bet.

  • This sounds more like a rumor than an answer. Can you explain why you feel differently than the accepted answer? – chicks Feb 27 '18 at 14:32
0

the /home directory should be 755 IMO. I use 755 or 750 on each user's /home/username directory for more privacy.

0

755 for /home

770 for individual user home folders or folder where you want to give write privileges to your group. In most cases, I set the last digits to 0 because if they are not in my group, I usualy dont want them to have any access at all.

I use 770. this way, people not in my group have no access whatsoever to the subfolders. With 775, people can still see your directory structure and names.

  • I would not recommend group write permission for a personal home directory. Maybe a shared service "drop box" for a pseudo-user's home dir, but there are better ways to implement that. – kmarsh Jan 15 '14 at 22:33
  • Agree about not having write for anyone but owner in the home tree. – Xalorous Nov 5 '16 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.