Date: Fri, 22 Oct 2004 17:06:06 +0300 From: Peter Pentchev <roam@ringlet.net> To: Bill Moran <wmoran@potentialtech.com> Cc: Jesper Wallin <jesper@hackunite.net> Subject: Re: Default permissions of /home/user.. Message-ID: <20041022140606.GA1043@straylight.m.ringlet.net> In-Reply-To: <20041022095512.31d991ae.wmoran@potentialtech.com> References: <1323.213.112.198.199.1098388008.squirrel@mail.hackunite.net> <20041022095512.31d991ae.wmoran@potentialtech.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On Fri, Oct 22, 2004 at 09:55:12AM -0400, Bill Moran wrote:
> "Jesper Wallin" <jesper@hackunite.net> wrote:
>
> > Hello..
> >
> > I've asked this question before without getting any further help really..
> > When a new user is added using "adduser" on 5.x (havn't really checked
> > if it's the same under 4.x or not), the default homedir permission is 755
> > (drwxr-xr-x) which to me, looks a bit insecure? It's of course pretty easy
> > to solve it by a simple chmod, but yet, isn't there anyway to change the
> > default chmod value? Last time I asked about this, people told me to check
> > out the skel directory, but the only thing you can do in there is to change the
> > default chmod value of the files/directories _in_ the homedir, not the chmod
> > values of the actually homedir.. I would be glad if someone could give me
> > further assistanse how do solve this without manually modifying the "adduser"
> > script.. and if it this option doesn't exist, shouldn't it be added or is it just
> > me who want my homedir secure from other users? ;)
>
> The adduser script does not determine the permissions on the home directoyr.
> The pw command does that, adduser just calls pw.
>
> I don't know, but perhaps if you change the permissions on /usr/share/skel
> itself, the new directories created from it will have those permissions
> (I haven't tried this, so I could be wrong).
>
> pw doesn't seem to have an option to change the permissions on the home
> directory at creation time. Possibly an option could be added to adduser,
> that reads the desired permissions from adduser.conf and changes them
> after creation?
Here's something I did back in 2002 for just this purpose. It is for
the 4.x adduser Perl script only - I've never ported it to the 5.x
adduser shell script, since I've never actually *used* it ever since its
conception :)
Still, if it could be of some help to anyone, here it is.
G'luck,
Peter
Index: src/usr.sbin/adduser/adduser.perl
===================================================================
RCS file: /home/ncvs/src/usr.sbin/adduser/adduser.perl,v
retrieving revision 1.44.2.4
diff -u -r1.44.2.4 adduser.perl
--- src/usr.sbin/adduser/adduser.perl 15 Feb 2002 17:31:15 -0000 1.44.2.4
+++ src/usr.sbin/adduser/adduser.perl 18 Feb 2002 14:12:46 -0000
@@ -41,6 +41,7 @@
$config_read = 1; # read config file
$logfile = "/var/log/adduser"; # logfile
$home = "/home"; # default HOME
+ $home_perm = "u+wrX,go-w"; # default permissions on HOME
$etc_shells = "/etc/shells";
$etc_passwd = "/etc/master.passwd";
$group = "/etc/group";
@@ -221,6 +222,33 @@
return 0;
}
+# return the default permissions' string for HOME
+sub home_permissions {
+ local($perm) = @_;
+ local($p) = $perm;
+
+ return $p if !$verbose && $p eq &home_permissions_valid($p);
+
+ while(1) {
+ $p = &confirm_list("Enter your default HOME permissions:", 1, $perm, "");
+ last if $p eq &home_permissions_valid($p);
+ }
+
+ $changes++ if $p ne $perm;
+ return $p;
+}
+
+# check for valid permissions
+sub home_permissions_valid {
+ local($perm) = @_;
+
+ if ($perm =~ /^((([ugo]+[+-][rwxX]+),?)+)/) {
+ return $1;
+ } else {
+ return "";
+ }
+}
+
# check for valid passwddb
sub passwd_check {
system(@pwd_mkdb, '-C', $etc_passwd);
@@ -953,7 +981,8 @@
if (!mkdir("$homedir", 0755)) {
warn "$dir: $!\n"; return 0;
}
- system 'chown', "$name:$group", $homedir;
+ system('chmod', $home_perm, $homedir);
+ system('chown', "$name:$group", $homedir);
return !$?;
}
@@ -961,7 +990,7 @@
# rename 'dot.foo' files to '.foo'
print "Copy files from $dotdir to $homedir\n" if $verbose;
system('cp', '-R', $dotdir, $homedir);
- system('chmod', '-R', 'u+wrX,go-w', $homedir);
+ system('chmod', '-R', $home_perm, $homedir);
system('chown', '-Rh', "$name:$group", $homedir);
# security
@@ -1365,6 +1394,9 @@
# default HOME directory ("/home")
home = "$home"
+# default permissions on HOME ("u+wrX,go-w")
+home_perm = "$home_perm";
+
# List of directories where shells located
# path = ('/bin', '/usr/bin', '/usr/local/bin')
path = ($shpath)
@@ -1425,6 +1457,7 @@
&shells_add; # maybe add some new shells
$defaultshell = &shell_default; # enter default shell
$home = &home_partition($home); # find HOME partition
+$home_perm = &home_permissions($home_perm); # set HOME permissions
$dotdir = &dotdir_default; # check $dotdir
$send_message = &message_default; # send message to new user
$defaultpasswd = &password_default; # maybe use password
--
Peter Pentchev roam@ringlet.net roam@cnsys.bg roam@FreeBSD.org
PGP key: http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553
This sentence contradicts itself - or rather - well, no, actually it doesn't!
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)
iD8DBQFBeRPO7Ri2jRYZRVMRAuDJAJ4m26pCthmiU8ZrZi+XIDqe6NUPEwCeIliM
uXZGfJBPbLo4nWOOxgPcOhI=
=q5w0
-----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041022140606.GA1043>