From owner-freebsd-questions@FreeBSD.ORG Wed Feb 11 19:36:37 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E619910656D1 for ; Wed, 11 Feb 2009 19:36:37 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from asmtpout018.mac.com (asmtpout018.mac.com [17.148.16.93]) by mx1.freebsd.org (Postfix) with ESMTP id D09718FC23 for ; Wed, 11 Feb 2009 19:36:37 +0000 (UTC) (envelope-from cswiger@mac.com) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Received: from cswiger1.apple.com ([17.227.140.124]) by asmtp018.mac.com (Sun Java(tm) System Messaging Server 6.3-7.03 (built Aug 7 2008; 32bit)) with ESMTPSA id <0KEX000CC2GY7Y10@asmtp018.mac.com> for freebsd-questions@freebsd.org; Wed, 11 Feb 2009 11:36:34 -0800 (PST) From: Chuck Swiger To: Keith Palmer In-reply-to: <53134.12.68.55.226.1234369337.squirrel@www.academickeys.com> X-Priority: 3 (Normal) References: <53134.12.68.55.226.1234369337.squirrel@www.academickeys.com> Message-id: Date: Wed, 11 Feb 2009 11:36:34 -0800 X-Mailer: Apple Mail (2.930.3) Cc: freebsd-questions@freebsd.org Subject: Re: Restricting users to their own home directories / not letting users view other users files...? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Feb 2009 19:36:38 -0000 On Feb 11, 2009, at 8:22 AM, Keith Palmer wrote: > We have a FreeBSD server with multiple users. I would rather each user > *not* be able to view other users' files via an SSH or SFTP session. > i.e. > if I'm logged in as "keith" I should *not* get a list of files when > I do > "ls /home/shannon" > > I realize I can fix this by setting the permissions on the "/home/ > shannon" > directory to 700. *However* then Apache (running as user "www") won't > display the documents in "/home/shannon/public_html" from > "http://ip-address/~shannon/", instead returning a "403 Forbidden" > error. This is an old, old problem; a reasonable solution is to create a $USER/private directory with 700 permissions for each user, and have them put anything which they consider "secret" under there. -- -Chuck