How do you limit user access to /home directory while still allowing a different user to access all /home/users

Question

My question is a bit complex. Basically, I want to give users ssh/sftp access to the server to their /home/user directory. I want to limit their ability to view other /home/user directories. Simple enough right? No. I want to have a seperate user (say apache) to have read access to all of the /home directories as well.

Right now I have the following perms:

drwxr-xr-x  14 root root   4096 Apr  3 15:41 home
...
cd /home
ll
drwxr-x--- 2 user1   user1   4096 Feb 10 14:16 user1
...

and I have added the user "apache" to the group for all users:

groups apache
apache : apache user1

The problem with this configuration is that when user1 logs in he can view /home/*

if I chmod the /home dir to 750 then when the user attempts to login he cannot get to his/her own folder.

Any suggestions?

Answer 1

Can you change the group access to read-only, add Apache to the group, and restrict all permissions to everyone else? Thereby allowing the owning user to modify their files at will whilst Apache and other services can only read?

I'm not much of a permissions guru, but I would think this would work.

Answer 2

My understanding is that you want most users to not be able to see the contents of /home, while still allowing them to log in and use the system normally, and allowing the apache group to see the contents of /home.

For directories, users must have execute permission to do ANYTHING with the contents, including cd to them. Thus, users without execute permission on /home will not be able to even see that their home directories exist, let alone start a shell in them.

Try this:

sudo chown root:apache /home  # owner=root, group=apache
sudo chmod 751 /home          # rwxr-x--x

This should allow the apache group to (and prevent all others from) list /home's contents, while still allowing each user to access their individual home directory.

Note that this does not prevent users from getting information on directories in /home if they already know their names. ls /home should not work, but ls -ld /home/$anything will. You can prevent non-apache users from doing anything inside others' home directories by setting them to $user:apache rwxr-x---:

sudo chown $user:apache ~$user  # owner=$user, group=apache
sudo chmod 750 ~$user           # rwxr-x---

You'll need to do this for each existing user with a home directory, and for each new user that you create, however.