In this lesson, you will learn how to configure Linux directory permissions to restrict unauthorized cross-user access, effectively preventing lateral movement within a shared environment.
The Principle of Least Privilege for Directories
By default, many Linux distributions set new user home directories with permissions that allow other users on the system to list the contents of those folders. While this seems benign, it allows a malicious actor—or a compromised service account—to scout for sensitive files, configuration scripts, or SSH keys belonging to other users. This is a primary vector for lateral movement.
To harden these directories, we enforce the principle of "private by default." We do this by stripping the "read" and "execute" bits for the "others" (the o in permission strings) on a user's home directory.
Implementing Strict Permissions
The standard permission set for a secure home directory is 700 (read, write, and execute for the owner only). You can apply this change recursively to ensure no files within the directory are inadvertently exposed:
# Set owner-only access for the user's home directory
chmod 700 /home/username
# Verify the changes
ls -ld /home/username
If you are a system administrator, you should also ensure that the default umask for new users is set to 077. This ensures that any new files or subdirectories created by a user are private by default, preventing the accidental creation of world-readable files. You can modify this in /etc/login.defs by setting UMASK 077.
Why this works
When you set the permissions to 700, the kernel prevents any process not running as the owner (or root) from entering the directory (x bit) or listing its contents (r bit). Even if an attacker gains shell access as a different low-privileged user, they will be met with "Permission Denied" errors when attempting to traverse into your home folder. By isolating these directories, you contain potential threats, ensuring that a breach in one user account does not automatically lead to the exposure of the entire system's user data.
Key Takeaway: Restricting directory permissions to 700 and enforcing a 077 umask are essential, foundational steps to isolate user data and stop attackers from moving laterally through your file system.