Linux – Folder permissions when using /etc/skel and pam

active-directorylinux

I have a Red Hat 5.8 server that is bound to active directory and users are authenticated via active directory when they log in via sftp. User home folders are created during login using /etc/pam.d/system-auth. The specific line that creates the home folder is

session optional pam_mkhomedir.so skel=/etc/skel/ umask=0066

This correctly gives home folders 711 permissions so no one else can read their directories. The problem is, the pam_mkhomedir.so also modifies permissions on all folders/files inside the /etc/skel folder which I don't want. There is a public_html folder (for apache) which needs to have 755 permissions so users can create web pages.

Is there a way for me to either a) stop pam_mkhomedir.so from recursively changing all the file permissions or b) create a script that creates the public_html folder after skel is copied and to set the correct permissions?

Best Answer

I don't think that you would want to keep the mkhomedir.so module from recursively changing all files, since public_html may not be the only folder/file that you have in your skeleton. But as far as I know the module doesn't allow non-recursion or excluding other specific directories from the umask.

You can certainly run a script afterwards to create the public_html directory, or even just modify the permissions of the already created public_html directory using the pam_exec.so module. See: PAM: Execute a command before pam_mkhomedir?

One other thought is that you could investigate changing the group on their home files/folders to a group that only Apache has access to and set the umask to 0026. This would give the Apache group full access to the user's home directory but not other users on the system.

Related Solutions

Linux And NTFS Permissions

I had a similar problem for a long time. For me, the solution was in the Linux filesystem permissions themselves. I had to change the permissions using chmod 2770 ./foo in order to get user and group permissions to work correctly. See my (edited) ls below:

[root@server1 home]# ls -lAF
total 92
drwxrws---.  2 al    al        4096 2009-05-27 00:25 al/
drwxrws---   6 root  shares    4096 2010-06-11 16:19 images/
drwxrws---. 61 jesse jesse     4096 2010-06-13 16:21 jesse/
drwxrws---. 28 mary  mary      4096 2009-08-26 15:52 mary/
drwxrws---. 14 root  work      4096 2010-05-24 08:16 work/
drwxrws---. 12 root  shares    4096 2010-06-18 14:15 share/
[root@server1 home]#

I am not using any admin users = entries. I am simply relying on the user and group structure built into Linux itself. Granted, you are using AD, but a similar concept should apply. For reference, here are the relevant parts of my smb.conf (edited again):

[global]
        server string = Samba Server
        security = share
        unix password sync = Yes
        create mask = 0660
        directory mask = 0770

[jesse]
        path = /home/jesse
        valid users = jesse
        read only = No

[share]
        path = /home/share
        valid users = al, jesse, mary
        read only = No

[work]
        path = /home/work
        valid users = al, jesse
        read only = No

I hope this helps!

Linux – How to Set Up Permissions for the WWW Folder

After more research it seems like another (possibly better way) to answer this would be to setup the www folder like so.

sudo usermod -a -G developer user1 (add each user to developer group)
sudo chgrp -R developer /var/www/site.com/ so that developers can work in there
sudo chmod -R 2774 /var/www/site.com/ so that only developers can create/edit files (other/world can read)
sudo chgrp -R www-data /var/www/site.com/uploads so that www-data (apache/nginx) can create uploads.

Since git runs as whatever user is calling it, then as long as the user is in the "developer" group they should be able to create folders, edit PHP files, and manage the git repository.

Note: In step (3): '2' in 2774 means to 'set Group ID' for the directory. This causes new files and sub directories created within it to inherit the group ID of the parent directory (instead of the primary group of the user) Reference: http://en.wikipedia.org/wiki/Setuid#setuid_and_setgid_on_directories

Best Answer

Related Solutions

Linux And NTFS Permissions

Linux – How to Set Up Permissions for the WWW Folder

Related Topic