In this lesson, you will learn how to implement system-wide configuration strategies to prevent sensitive data leakage between users on a shared Linux server.
When multiple users share a server, the default behavior of many Linux distributions is to create home directories with permissive read access (e.g., 755 permissions). While this allows users to see each other's home folders, it often exposes sensitive configuration files, SSH keys, or project data that should remain private. Hardening these directories is a fundamental step in enforcing the Principle of Least Privilege.
Controlling Permissions at Scale
Instead of manually chmodding every directory, we manage home directory security at the system level using the UMASK setting in /etc/login.defs. This file dictates the default permissions applied when a user account is created via useradd.
By setting the UMASK to 077, you ensure that new home directories are created with 700 permissions (read, write, and execute only for the owner).
# Check your current umask setting
grep UMASK /etc/login.defs
# Set to 077 for maximum privacy
# In /etc/login.defs:
UMASK 077
Addressing Legacy Directories
Changing /etc/login.defs only affects future accounts. To harden existing users, you must audit and remediate current directories. If you have already mastered Mandatory Access Control (MAC) systems like SELinux or AppArmor, you should augment these directory permissions with security labels.
For example, using SELinux, you can ensure that even if a directory’s POSIX permissions are accidentally modified, the kernel-level context prevents unauthorized access:
# Verify the security context of a home directory
ls -Zd /home/username
# Ensure the home directory is labeled strictly for the user domain
chcon -R -t user_home_dir_t /home/username
By combining restrictive UMASK defaults with MAC policies, you transform the shared filesystem into a series of isolated silos, effectively mitigating the threat of cross-user data exposure.
Key Takeaway: Hardening home directories requires aligning your system-wide account creation templates with rigorous Mandatory Access Control policies to ensure that user data remains invisible to unauthorized peers by default.