Protect your files

Introduction

Your homedirectory is the location where you store your files on the network. The actual data is stored on one of the central fileservers. The FNWI fileservers are all Sun Solaris based (Sun's UNIX implementation).

Depending on which type of workstation you use different methods are used to access your homedirectory.

On Windows systems your homedirectory is available to you through a network disk that is always connected to drive letter "N:".

On Macintosh systems your homedirectory is available to you through a network disk named "username on servername" located on the desktop.

On unix (Linux, Solaris, HPUX) your homedirectory is available to you as "/home/username", or simply by issueing the "cd" command.

Permissions

The fileservers provide a simple, yet powerful, protection mechanism. Every file and directory (folder) has three access permissions:

• the rights for the file owner,
• the rights for the group you belong to,
• the rights for all others in the faculty.

If you are member of a research institute the group constitutes the institute staff.

If your are working in the faculty organisation the group is the department you work for (e.g., "fz", "pz" or "arbo").

The owner, the group and all others can have any combination of access permissions from:

permission	applied to file	applied to directory/folder
Read	read the file	see the contents
Write	modify the file	create/delete files and subdirectories
Execute	execute a program file	open the directory

Note that the Execute permission has a different meaning for files and directories.

For a file if the Execute permission is set, you can run (execute) the program. In a graphical userinterface you can double click on it and the program starts executing.

For a directory if the Execute permission is set, you can open the directory, which is also accomplished by double clicking on it when using a graphical userinterface. But contrary to a normal file, to see the contents of a directory -even when you are allowed to open it- you must also have Read permission.

The default permissions

For all users the default permissions for your homedirectory are:

User	Permission
Owner	Read + Write + Execute
Group	Execute
Others	Execute

So the owner of the homedirectory (you) can do everything with it; the group members and the others can only open the directory but not see what's in it.

Since the group cannot see the contents of your homedirectory you may tell a member of the group the name of a file or directory in your homedirectory which they can access.

The reason for giving others Execute permission to your homedirectory is to allow the webserver to access the "public_html" subdirectory in your homedirectory where you should store your personal homepage.

Changing the permissions

Before trying to change the permissions on your homedirectory, please make sure you understand the permission system. Generally there is no need to change the permissions for your homedirectory since permissions to it are configured once by the ICT group.

If you change permissions and relax the permissions you may give access to users within your department, or even to others. So be careful, and remember: it's your own responsibility.

Changing the permissions to your homedirectory is achieved differently depending on the workstation that you use.

Of course this applies also for other directories and files that you own.

Using UNIX

On Solaris, Linux and HPUX workstations you change file and directory permissions through the "chmod" command.

For example,

    cd
    chmod o+r .

    cd
    chmod o+rwx .

To change your own permissions use the prefix "u" and for the group permissions use the prefix "g". E.g., "chmod g+w ." and "chmod u+w .".

For more details on the chmod command, see "man chmod".

Some windowmanagers (kde, gnome, etc) allow you to select the "properties" window for a file or directory which presents a graphical interface to the same permission system.

Using Windows NT

Open the explorer or "My computer" Right click on the icon or line of your home directory Choose the option "properties" (a dialog window appears) Choose the "Security" tab Choose "permissions" (the dialog window to the right will appear) The permissions can be changed by using the dropdown menu behind "Type of access".

Using Windows 2000

Open the explorer or "My computer" Right click on the icon or line of your home directory Choose the option "properties" Choose the "Security" tab (the dialog window to the right will be presented) The permissions can be changed by marking the option buttons in the lower pane.

Using Windows XP

Open the explorer or "My computer" Right click on the icon or line of your home directory Choose the option "properties" Choose the "Security" tab (the dialog window to the right will be presented) The permissions can be changed by marking the option buttons in the lower pane.

Using MacOS 9

select the icon of your home directory on the desktop click on "File", and choose "General info" or type command key + "i" choose for the option "Sharing" (behind "show"), the dialog window to the right will be presented The permissions can be changed by clicking on the buttons under "privileges". Note: the "execute" permission is not available.

Using MacOS X

select the icon of your home directory on the desktop click on "File" and choose "Get info or type command key + "i" Click on "Ownership and Permissions" (the dialog window to the right will be presented) The permissions can be changed by clicking on the buttons behind "Access". Note: the "execute" permission is not available. However, when using the "terminal application", the Unix chmod command may be used (see above under "Unix").

Your personal home page

If you want to create a personal homepage, you must create a subdirectory named "public_html" in your homedirectory. If someone on the internet accesses

    http://www.science.uva.nl/~username

To be able to search the contents of the "public_html" directory, the webserver "nobody" must also have Read and Execute permissions on the "public_html" directory in order to search in that directory.

The hairy details

File and directory permissions lie at the very core of operating systems and are part of the filesystem semantics. Different operating systems have different filesystem semantics.

The filesystem semantics for Solaris, Linux, HPUX, MacOS X and other UNICES are all the same.

Windows and MacOS 9 have completely different filesystem semantics. We will not discuss MacOS 9 here since it will soon be obsolete.

The Windows filesystem semantics lists the following permissions:

permission	applied to file	applied to directory/folder
Read	read the file	see the contents
Write	modify the file	add items to the directory
Execute	execute a program file	open the directory
Delete	delete the file	delete the directory
Change Permission	change permissions	change permissions
Take Ownership	become owner	become owner

In the Windows filesystem only the owner is recorded; unlike in UNIX there is no group ownership associated with a file or a directory.

Windows ACLs

This leads to the question "how is it then possible to give a group access to a file or directory?"

The file permissions are stored in so called Access Control Lists or ACLs. To give a group a permission to a file or directory you simply add the group to the ACL and give the group one or more permissions. All this is done through the Security tab in the Properties window of the file or directory.

UNIX ACLs

In view of the Windows ACL system, the UNIX filepermissions seem inadequate. Not so, UNIX also has ACLs, but many people don't know them.

Consider the chmod command

    chmod u=rwx,g=rx,o=x somedirectory

Enter the UNIX ACL system. Apply the following command to the "somedirectory":

    setfacl -m user:someuser:r-x somedirectory

This adds the user "someuser" to the ACL controlling access to "somedirectory" and permits read and open access.

UNIX ACLs use the same Read Write and Execute permissions and extend the standard permission system.

For more information on ACLs, see the manualpages for "setfacl" and "getfacl".