Re: about shadow adduser homedir creation?

On Mon, 2 May 2005 21:17:40 +0300 (EEST)
"Eero Volotinen" <[email protected]> wrote:
> > I was thinking that some might want 700, other 711 (those with Apache's
> > public_html
> > functionality), other 770 or 771 (those under the "one group per user"
> > conept). I think 711
> > fits all three cases relatively secure. I thought adding a diretive to
> > /etc/default/useradd to
> > set the default umask (recommending "066") and an option to override it
> > would be a better
> > solution.
> 
> Well. How this sounds:
> 
> By default home directories are made with "0700" if there is no
> /etc/default/useradd -file where is parameter HOMECREATEMASK=xxx, where
> xxx is value.

I was checking the code... looks like it is currently tied to the UMASK value from /etc/login.defs. I guess changing it to behave like Eero says would break some systems.

So I think it would be best to add a HOMEPERMISSIONSOVERRIDE=xxx that, when absent, defaults to the current behavior.

From man login.defs:

       UMASK (number)
              The permission mask is initialized to this value.  If not specified, the permission mask will be initialized to 077.

The permission mask of what, the user at login, or the home directory?

</on-topic>

For "users", please assume "newbie users that don't necessarily know anything about chmod and permissions"

What I, personally, am trying to solve here, is that my users must have a default umask of 002, because some of them work in projects for which a directory exists, for instance a webmaster team. I'm doing this by creating /projects/webmasters, a "web" group and chmodding g+s to it. These are the possibilities.

a. Leaving everything as it is, but web collaborator 1 won't be able to modify files of web collaborator 2, even if files are saved in /project/webmasters. Besides, currently, each user is allowed to go and read files of other users. This is not good for users in computer labs who want to protect their homeworks.
b. Set UMASK to 002 in login.defs, but useradd -m user by itself doesn't lock home directory correctly on creation, allowing every user to destroy every other user's home dir.
c. Use private groups, a la RedHat, but I don't like the idea of users not belonging to a common group.
d. Set UMASK to 066 in login.defs and set umask to 002 in a login script but... will login and --after-- the profile code will honor the umask and leave the user working with 002?

Any other ideas?

Octavio.