Date: Tue, 23 Jun 1998 18:53:57 -0500 From: "Matthew D. Fuller" <fullermd@futuresouth.com> To: Open Systems Networking <opsys@mail.webspan.net> Cc: freebsd-security@FreeBSD.ORG Subject: Re: adduser chmod permissions Message-ID: <19980623185357.25223@futuresouth.com> In-Reply-To: <Pine.BSF.3.95.980623120946.4022C-200000@orion.webspan.net>; from Open Systems Networking on Tue, Jun 23, 1998 at 12:24:16PM -0400 References: <Pine.BSF.3.95.980623120946.4022C-200000@orion.webspan.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Jun 23, 1998 at 12:24:16PM -0400, Open Systems Networking woke me up to tell me: > > I've sent this to a couple of people now. > > This pertains to adduser on 3.0-current. > I havent checked on a 2.2x adduser. > I'm wondering what purpose if any the perms on "other" have in adduser. > > adduser is set to o=-w. Why by default should adduser allow home > directories to be executable and read by "others". I mean if the default > policy of IPFW is to default to closed, and the admin has to choose to > open up his server, shouldnt the default for adduser be to create home > dirs closed to "others" and the user has to open them up? Makes sense to > me anyway. I think having adduser have ANY perms on other brekas the man > page. Well, for starters, you'll need to have at least execute to have web directories under ~. There's a great difference in philosophy between home dirs and IPFW. If you're running IPFW, that's because you want to keep things out. If you have home directories, that's because you want users. Part of the philosophy that's been with unices from the beginning is sharing of information. Having readable home dirs makes that possible. I've always had my umask as 077. My home dir is readable, but the files aren't. If I have files I want to share, I chmod them so they're readable (or executable, ATCMB). It really comes down to 2 philosophies: 1) Share unless there's a reason to not, and 2) Hide unless there's a reason to share I happen to like 1. It was one of the cornerstones of unix in the first place; share unless there's a reason not to, and when not sharing, lock it down tight. And as for 'each user in their own group', well, that defeats some of the niceness of groups. I have a group user, which all normal users belong to, and no others. So if someone breaks in as 'daemon' or 'nobody', they can't get at a lot of stuff, whereas normal users have no problem. Sorry, I only have a dime. Need $.08 change, please. *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* | FreeBSD; the way computers were meant to be | * "The only reason I'm burning my candle at both ends, is * | that I haven't figured out how to light the middle yet."| * fullermd@futuresouth.com :-} MAtthew Fuller * | http://keystone.westminster.edu/~fullermd | *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19980623185357.25223>