Bash – Fedora 20: Users cannot enter their home directory

bashfedorasamba

Running Fedora 20 on a file server and ran into this strange issue, not sure what I'm doing wrong. The account I made while installing the OS works fine, but every other account I made has this problem.

When trying to login with su - USERNAME I get the following error:

su: warning: cannot change directory to /home/USERNAME: Permission denied
-bash: /home/USERNAME/.bash_profile: Permission denied

And from there bash just hangs in the terminal and I have to close it. If I try to login from the login screen, I get the same error popped up in a message box and after a short time I'm kicked back to the login screen.

If I ls -l any of the home directories, aside from the one I made at install, they contain 0 files. The permissions on the home directories are all set to 700 with the owner and group set to each users username and group.

I've also tried making a new user in the GUI and then switching to that user, but I get the same error.

Users need to be able to login through Samba to access file shares. Even though the login is successful, they have no permissions and get access denied.

Any ideas?

ls -ld / shows 755 root root for permissions
ls -ld /home shows 700 acase acase for permissions. This is the user I made when installing the OS and the only one that works, is this the issue?

As for SELinux, I have not yet tried disabling it. I'm new to SELinux but when I cat the audit log and grep for 'acct="USERNAME"' of one of the new accounts, I only see 4 messages and their status is SUCESS. I'll try disabling it and see if it changes anything.

Best Answer

Set the permissions on /home to 711, not 700. Execute permission is required to access anything within a directory by name, so all users need execute permission on / and /home to access /home/theirname. Omitting read permission will prevent them from listing all the other subdirectories of /home.

Permissions on the home directories themselves can be 700. This way, even if someone guesses another user's name, they won't be able to access that user's directory.

Related Question