! Important security change: Tightening of access rights to home directories.

! Important security change: Tightening of access rights to home directories.

Based on the results of recent penetration tests and recommendations from the CESNET security team, we are introducing an important change to the access rights settings for home directories. The goal of this step is to ensure maximum security for your data.

• Starting October 5th, there will be a blanket removal of read and execute permissions on home directories for all other users and members of your groups (chmod go-rwx /home/*)
• Home directories will thus be newly by default accessible only to their owner
• New accounts will be automatically created with this setting going forward

Who will be affected by the change 

The change will affect users who currently have read permissions set on their home directory for their user group or other users. The blanket reconfiguration of directories will prevent this previous way of working.

How to continue sharing data?

However, we realize that sharing data with colleagues is often crucial for your work, and we do not want to deprive you of this option:

• For secure data sharing, we have prepared a new utility share-dir-nfsfacl, which
  • allows you, without the need for complex manual configuration of extended ACL rights, to easily share a selected subdirectory or file with a specific group or user
  • allows you to revoke sharing and clearly list the current permission settings
• Detailed documentation on using the utility: Data sharing using ACL
• Compliance with making the roots of the home directories themselves inaccessible will be automatically handled by a regular system script, which will monitor the closure of /home

If you know that you use data sharing in /home directories, please configure the necessary ACL settings using the mentioned utility as soon as possible. 

If you do not know how to handle sharing or encounter any problems after the rollout, do not hesitate to contact our user support.

We apologize for any inconvenience caused by this change and thank you for your understanding of these steps, which lead to higher security of our shared infrastructure.

Your MetaCentrum