zhangyiss/the-littlest-jupyterhub
1
0
Fork 0
mirror of https://github.com/jupyterhub/the-littlest-jupyterhub.git synced 2025-12-18 21:54:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

Don't create home publicly readable

Browse Source 
World-Readable seem to be a surprising default for many people,
especially in teaching context. Switch to a more reasonable rwxr-x---

We have to issue a chmod, as changing at creation time would require
changin /etc/adduser.conf DIR_MODE=0760 (or whatever), but that seem
unwise.

We do not set the exact permission in case the DIR_MODE is more
restrictive.

Closing #158
This commit is contained in:
Matthias Bussonnier
2018-08-29 11:04:07 -07:00
parent 91b405dee2
commit 552db9f74d
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/topic/security.rst
View File

@@ -22,6 +22,10 @@ permissions.
#. A home directory is created for the user under ``/home/jupyter-<username>``. #. A home directory is created for the user under ``/home/jupyter-<username>``.
#. The default permission of the home directory is change with ``o-rwx`` (remove
non-group members the ability to read, write or list files and folders in the
Home directory).
#. No password is set for this unix system user by default. The password used #. No password is set for this unix system user by default. The password used
to log in to JupyterHub (if using an authenticator that requires a password) to log in to JupyterHub (if using an authenticator that requires a password)
is not related to the unix user's password in any form. is not related to the unix user's password in any form.

7
tljh/user.py
View File

@@ -6,6 +6,7 @@ Supports minimal user & group management
import pwd import pwd
import grp import grp
import subprocess import subprocess
from os.path import expanduser
def ensure_user(username): def ensure_user(username):
@@ -27,6 +28,12 @@ def ensure_user(username):
username username
]) ])
subprocess.check_call([
'chmod',
'o-rwx',
expanduser('~{username}'.format(username=username))
])
def remove_user(username): def remove_user(username):
""" """