特殊:Badtitle/NS100:UbuntuLTSP/LockdownHomeDirs
文章出处: |
{{#if: | {{{2}}} | https://help.ubuntu.com/community/UbuntuLTSP/LockdownHomeDirs }} |
点击翻译: |
English {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/af | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|Afrikaans| [[::UbuntuLTSP/LockdownHomeDirs/af|Afrikaans]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/ar | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|العربية| [[::UbuntuLTSP/LockdownHomeDirs/ar|العربية]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/az | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|azərbaycanca| [[::UbuntuLTSP/LockdownHomeDirs/az|azərbaycanca]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/bcc | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|جهلسری بلوچی| [[::UbuntuLTSP/LockdownHomeDirs/bcc|جهلسری بلوچی]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/bg | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|български| [[::UbuntuLTSP/LockdownHomeDirs/bg|български]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/br | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|brezhoneg| [[::UbuntuLTSP/LockdownHomeDirs/br|brezhoneg]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/ca | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|català| [[::UbuntuLTSP/LockdownHomeDirs/ca|català]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/cs | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|čeština| [[::UbuntuLTSP/LockdownHomeDirs/cs|čeština]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/de | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|Deutsch| [[::UbuntuLTSP/LockdownHomeDirs/de|Deutsch]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/el | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|Ελληνικά| [[::UbuntuLTSP/LockdownHomeDirs/el|Ελληνικά]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/es | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|español| [[::UbuntuLTSP/LockdownHomeDirs/es|español]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/fa | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|فارسی| [[::UbuntuLTSP/LockdownHomeDirs/fa|فارسی]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/fi | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|suomi| [[::UbuntuLTSP/LockdownHomeDirs/fi|suomi]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/fr | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|français| [[::UbuntuLTSP/LockdownHomeDirs/fr|français]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/gu | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|ગુજરાતી| [[::UbuntuLTSP/LockdownHomeDirs/gu|ગુજરાતી]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/he | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|עברית| [[::UbuntuLTSP/LockdownHomeDirs/he|עברית]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/hu | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|magyar| [[::UbuntuLTSP/LockdownHomeDirs/hu|magyar]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/id | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|Bahasa Indonesia| [[::UbuntuLTSP/LockdownHomeDirs/id|Bahasa Indonesia]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/it | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|italiano| [[::UbuntuLTSP/LockdownHomeDirs/it|italiano]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/ja | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|日本語| [[::UbuntuLTSP/LockdownHomeDirs/ja|日本語]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/ko | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|한국어| [[::UbuntuLTSP/LockdownHomeDirs/ko|한국어]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/ksh | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|Ripoarisch| [[::UbuntuLTSP/LockdownHomeDirs/ksh|Ripoarisch]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/mr | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|मराठी| [[::UbuntuLTSP/LockdownHomeDirs/mr|मराठी]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/ms | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|Bahasa Melayu| [[::UbuntuLTSP/LockdownHomeDirs/ms|Bahasa Melayu]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/nl | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|Nederlands| [[::UbuntuLTSP/LockdownHomeDirs/nl|Nederlands]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/no | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|norsk| [[::UbuntuLTSP/LockdownHomeDirs/no|norsk]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/oc | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|occitan| [[::UbuntuLTSP/LockdownHomeDirs/oc|occitan]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/pl | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|polski| [[::UbuntuLTSP/LockdownHomeDirs/pl|polski]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/pt | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|português| [[::UbuntuLTSP/LockdownHomeDirs/pt|português]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/ro | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|română| [[::UbuntuLTSP/LockdownHomeDirs/ro|română]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/ru | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|русский| [[::UbuntuLTSP/LockdownHomeDirs/ru|русский]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/si | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|සිංහල| [[::UbuntuLTSP/LockdownHomeDirs/si|සිංහල]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/sq | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|shqip| [[::UbuntuLTSP/LockdownHomeDirs/sq|shqip]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/sr | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|српски / srpski| [[::UbuntuLTSP/LockdownHomeDirs/sr|српски / srpski]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/sv | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|svenska| [[::UbuntuLTSP/LockdownHomeDirs/sv|svenska]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/th | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|ไทย| [[::UbuntuLTSP/LockdownHomeDirs/th|ไทย]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/tr | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|Türkçe| [[::UbuntuLTSP/LockdownHomeDirs/tr|Türkçe]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/vi | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|Tiếng Việt| [[::UbuntuLTSP/LockdownHomeDirs/vi|Tiếng Việt]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/yue | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|粵語| [[::UbuntuLTSP/LockdownHomeDirs/yue|粵語]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/zh | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|中文| [[::UbuntuLTSP/LockdownHomeDirs/zh|中文]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/zh-hans | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|中文(简体)| [[::UbuntuLTSP/LockdownHomeDirs/zh-hans|中文(简体)]]}}|}} {{#ifexist: {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | UbuntuHelp:UbuntuLTSP/LockdownHomeDirs | {{#if: | :}}UbuntuLTSP/LockdownHomeDirs}}/zh-hant | • {{#if: UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|中文(繁體)| [[::UbuntuLTSP/LockdownHomeDirs/zh-hant|中文(繁體)]]}}|}} |
{{#ifeq:UbuntuHelp:UbuntuLTSP/LockdownHomeDirs|:UbuntuLTSP/LockdownHomeDirs|请不要直接编辑翻译本页,本页将定期与来源同步。}} |
{{#ifexist: :UbuntuLTSP/LockdownHomeDirs/zh | | {{#ifexist: UbuntuLTSP/LockdownHomeDirs/zh | | {{#ifeq: {{#titleparts:UbuntuLTSP/LockdownHomeDirs|1|-1|}} | zh | | }} }} }} {{#ifeq: {{#titleparts:UbuntuLTSP/LockdownHomeDirs|1|-1|}} | zh | | }}
This page is dedicated to locking down user home directories. This is necessary because, by default, Ubuntu likes to give the "other" group (everyone on the system) r-x (read/execute) permissions by default. This is not acceptable in an educational environment, as any student would be able to navigate to any other student's (or teacher's) home directory to, at the very least, open/read their files. Here are the steps to lock down user home directories, so only the logged-in student (and any teacher/admin staff in the "admin" group) will have access to user directories: First, change filesystem permissions on all existing user home directories so that only the owner and group have rwx permissions:
cd /home sudo chmod 770 *
Now, change the group owner to the "admin" group (only teachers and/or system administrators/techs should be a member of the "admin" group, as it is used for system administration purposes):
sudo chgrp admin *
NOTE: This only allows entering the users' directories as it doesn't recursively change permissions on enclosed files. To ensure all current and future files are created with the proper permissions for the 'admin' group to read/write/execute them, we must either use SetUID on the group bits, or use ACLs. I will document this soon and this note will be removed. Lastly, to prevent newly created users from creating homedirs with the same bad permissions, edit the /etc/adduser.conf file to make the default permissions sane:
sudo vim /etc/adduser.conf
adduser.conf:
... # If DIR_MODE is set, directories will be created with the specified # mode. Otherwise the default mode 0755 will be used. DIR_MODE=0770 ...
If you'd like to add more fine-grained access control to individual user home directories, see This|page on ACL support in Ubuntu. Have fun!