Wrong home directory permissions for new users

Hi everyone.
I reinstalled my laptop the other day and ran into a rather strange problem: after a system update new users had their permissions totally screwed. It took me 3-4 reinstalls to notice, as i was also playing with lvm2 &co. Anyway, on fresh installations from either 2008.06 or 2009.02, everything works fine. As soon as i update to the latest package versions (including 2.6.29 kernel) and create a new user, permissions on the new home directory are screwed up to the point where the user can't access it.
Old directory permissions:
drwx------ 33 jasn users 4,0K 17. Apr 13:21 jasn
drwx------ 2 root root 16K 17. Apr 12:15 lost+found
New directory permissions:
drw-rw--w- 2 jasm users 4,0K 17. Apr 13:43 jasm
drwx------ 33 jasn users 4,0K 17. Apr 13:21 jasn
drwx------ 2 root root 16K 17. Apr 12:15 lost+found
Logging in to "jasm" results in
No directory, logging in with HOME=/
[jasm@host /]$
The whole mess can be fixed by changing the permissions on the home directory, but all that can't be on purpose, can it? I also don't know which package update (if it even was caused by one) causes this behaviour and if this only happens to me, so i didn't file a bug report.
Has anyone already seen this? I solved it after 1.5 days of puzzled (and strangely unsuccessful) googling and reinstalling, so perhaps someone who runs into the same problem can use this to fix it.
Last edited by JASN (2009-04-17 17:09:34)

umask is not really the correct thing to do in this case, as this resets the permissions for every file the user creates. Afaik, the umask setting has to be installed on every machine via the launchd-user.conf file (to contain simply: umask 002) (or whatever is appropriate for your facility), as umask is a property of the process, not the connection.
What might work better for your problem is make the homedirs world and group non-readable. That way the user creates files within their homedirs and anywhere below, but everyone else can't read them regardless of the files' permissions because the directory itself is unreadable.

Similar Messages

Home Directory Permissions on New Files/Folders

Problem: When a user creates a file or folder in the root of their home folder (ie. not in their Documents or other default folder) it is given "read" access to the "others" POSIX permission. So, anyone browsing the "users" folder on the network can view those files or folders. I would like to change this behavior so that when a user creates a file or folder, it is only read/write for the user and nothing for everyone else.

umask is not really the correct thing to do in this case, as this resets the permissions for every file the user creates. Afaik, the umask setting has to be installed on every machine via the launchd-user.conf file (to contain simply: umask 002) (or whatever is appropriate for your facility), as umask is a property of the process, not the connection.
What might work better for your problem is make the homedirs world and group non-readable. That way the user creates files within their homedirs and anywhere below, but everyone else can't read them regardless of the files' permissions because the directory itself is unreadable.

Home directory creation for local user accounts using powershell

Through Computer Management when I create a user, a home directory is created for the same user in the folder C:\Users.I am creating a user through powershell in a remote machine.I am using the following script to create user
$comp = [ADSI]'WinNT://localhost,computer';
$user = $comp.Create('User', 'account7');
$user.SetPassword('Welcome1');
$user.SetInfo();
The account is getting created. But no home directory is created for this user. How to create a home directory for a user using powershell? Also the user created through GUI is a member of the group 'Users' by default. How to add the user created to the
'Users' Group.

Hi Cmm user,
Thanks for your posting.
To set the attribute of homedirectory for a user in powershell, please also try the cmdlet set-aduser:
import-module activedirectory
$HomeDrive=’Z:’
$UserRoot=’\\CONTOSO-FPS\Users$\’
$HomeDirectory=$UserRoot+$AccountName
SET-ADUSER $AccountName –HomeDrive $HomeDrive –HomeDirectory $HomeDirectory
I hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

How can I change Aperture permissions for new user account

I migrated my old user account (Ezra) to my new Mac mini from my old MBP laptop, but it would not allow me to keep the same name, (Ezra) so I picked a new one (Karyn). The problem is that now I can't access any of my other Aperture Libraries on my external storage array (Drobo) due to permissions errors. What is the best course of action to get back to working with Aperture? Is there a way to change an existing user account name to match what it used to be? I want the (Ezra) account from the Mac mini to eventually migrate to a freshly purchased Macbook Air later, then I could delete it from the Mac mini to rid the problem of duplicate user account names.

Sounds like when you installed the new system you created a user account on it and then used migration assistant to copy over the files from the old system,. IS this correct?
If so you will have other problems down the road with other applications also. The best thing to so if you still have the old system and have not done to much work on the new system is to redo the install and use setup assistant. This way your old account will be brought over to the new system and you will not have permissions problems.
You can try one thing. Do a Get Info on the Drobo Drive and see if at the bottom of the Info window you see this:
If that is there for the drive (and I don;t know if the Drobo will have this option) you can select the box and you might be able to get at your libraries.
As I wrote however, even of you fix this problem there is a good chance you will run into others later on.
regards

Repair Home Directory Permissions in Lion

I currently have my home directory on it's own physical disk (not in the default location on my OS drive).
When I try to "reset home directory permissions" against my user account in OS X Lion, nothing happens. When I do it for a user who has his home directory on the OS drive, everything works like a champ. The same thing happens under Snow Leopard as well, and I've been trying to track down a solution to this for a long time.
Does anyone know how to fix this? I tried setting the permissions, ACL's, extended atttributes, etc to the best of my ability using Unix commands, and I'm not really having any issues at the moment, but I'd like to be able to set everything back to the way it should be in my home directory.
Also, I don't have enough space on my OS drive to move my home directory back to the default location in order to do the reset.
Any help would be appreciated.
Bobby

If you go into System Preferences / Users, you can right click on your User account and choose advanced options. In there, you are able to point your users directory to any disk (or folder) on your machine. I chose to move my home directory to a separate drive in my Mac Pro to make rebuilds easier. Now if I want to reinstall my OS, I simply blow the existing OS away, format the OS disk, and once a fresh OS is installed, I just re-point my account to the existing drive where my home directory is, and all is cool. It's definitely a supported configuration by Apple, and many people do it. It's just aggravating that their "reset home directory permissions" routine doesn't like it.
My OS drive is a 128gb SSD, and my home directory sits on a 3tb HDD. From a performance and separation perspective it's perfect.
Bobby

Read-only access permissions for new files/folders?

System:
Clean Install on new intel Xserve
10.4.8 Server w/ Open Directory
Windows clients can read/write completely fine...
Clients connecting using AFP (whether Standard or Kerberos authentication) can access files, but when new files/folders are created on the server, they register as full permissions for the user who created them, but not for the rest of the group.
The share(s) in question are set using POSIX from WGM: Full access for owner/group/everyone (changed it to this thinking it would help, but it does not). Of course, no one can make changes to a newly-created/deposited files/folders, which is just plain silly.
I can chmod the permissions recursively from a script (which fixes the problem, of course) on a regular basis so that its not (as much of) an issue, but there is still a 5-minute lag for the script to kick in, since we don't want to bombard the server with chmod requests every minute....which is unnecessary in the first place!
I have plenty of other setups which are identical but have no such issue...
Any reason why POSIX permissions on the share are being ignored from every user account?
Thanks,
k

"That's default posix behaviour no matter what access permissions you set on the sharepoint."
I'm afraid this is dead wrong. What matters most is how you set permissions on the share, not if you've chosen to inherit vs. using POSIX. POSIX is still used in inherit functions, though you can use ACL's to override them. In this case, ACL's are not being used on those shares (though we tried it).
After all, why would Apple (let alone anyone else) even offer the ability to change POSIX permissions on a share if it didn't have any effect? That would be somewhat contradictory in nature.
Like I said before, I have several other installations which are identically setup that have no such issues.
As for Windows, it is also not set to inherit permissions; we're setting those explicitly. And they work fine.
Any other ideas?
Thanks,
k

Windows 7 Home Premium problem creating new user account

I am unable to create a new user account on my Windows 7 Home Premium computer. I have 3 accounts on it already, two are adminstrators, and just trying to add a fourth one (standard user).
I go to User Accounts, click Create new account, give it a name, keep Standard user checked, and press Create Account. The account appears to get created and shows up on the User Accounts screen, though it shows that it is password protected already, even
though I didn't have an opportunity to give it a password yet. I can manage that new user account and delete the password, and it then shows up on User Accounts as not having a password.
When I try to log on as that user from the main logon screen, it prompts me for the password (if I have specified one), but it doesn't accept the password (I've tried defining and using various ones), and I get the message "The user name or password is incorrect".
If I don't define a password for that account, when I click on the account button to logon, I get that same error message immediately.
I also noticed that C:\Users doesn't include the new user account folder there. Don't know if that should've been created at this point before logging on for the first time. I also noticed that there's a "Default User" folder that has a lock on the folder
icon, and I'm not able to open that folder (says it's invalid). There is a "Default" folder there with some content in it and I am able to view it. Don't know if either of these folders act as templates for new users.
At some point months ago I did have a profile problem with one of the existing accounts, and had to follow some suggestions on repairing that user profile. Don't know if that perhaps has complicated things. The 3 existing user accounts are working fine.
Any tips on what I can try to get a new account established?
Thanks, Chuck
Chuck Mastrandrea

I am unable to create a new user account on my Windows 7 Home Premium computer. I have 3 accounts on it already, two are adminstrators, and just trying to add a fourth one (standard user).
I go to User Accounts, click Create new account, give it a name, keep Standard user checked, and press Create Account. The account appears to get created and shows up on the User Accounts screen, though it shows that it is password protected already, even
though I didn't have an opportunity to give it a password yet. I can manage that new user account and delete the password, and it then shows up on User Accounts as not having a password.
When I try to log on as that user from the main logon screen, it prompts me for the password (if I have specified one), but it doesn't accept the password (I've tried defining and using various ones), and I get the message "The user name or password
is incorrect". If I don't define a password for that account, when I click on the account button to logon, I get that same error message immediately.
I also noticed that C:\Users doesn't include the new user account folder there. Don't know if that should've been created at this point before logging on for the first time. I also noticed that there's a "Default User" folder that has a lock on
the folder icon, and I'm not able to open that folder (says it's invalid). There is a "Default" folder there with some content in it and I am able to view it. Don't know if either of these folders act as templates for new users.
At some point months ago I did have a profile problem with one of the existing accounts, and had to follow some suggestions on repairing that user profile. Don't know if that perhaps has complicated things. The 3 existing user accounts are working fine.
Any tips on what I can try to get a new account established?
Thanks, Chuck
Chuck Mastrandrea
I agree with the same problem and the answer below did not work either. I tried changing permissions to Users directory and that did not work either. I even tried creating the directory name of user I wanted to install and that was recognized and
being used, but will not start a user directory for new user.

How to check whether a file got read permissions for perticular user

Problem: Let JRE is running with some x as effective user in LINUX then while checking file permission it is checking permission on that file for that x user.
File f = new File(�file name�)
if(f.exists())
System.out.println(�exists�);
Else
System.out.println(�does not exists�);
The above code prints exists only when x user have permissions on that file
Requirement: I would like to check whether a file got read permissions for particular user i.e. whether y user got permissions on that file.
Any help is appreciated

In Linux a user has to have read permission on a file to even see that it exists. As a result, if a user (or a group to which they belong) doesn't have read access to the file File.exists() will return false. Windows which doesn't have as tightly controlled access to files will admit that a file exists whether it can be read or not.
PS.
This is proof that I should never answer a question off the top of my head when I haven't had my red bull yet. This is wrong. You will be able to see it if you have read and execute on the directory.
thumps self in head
Message was edited by:
puckstopper31

Pre-populate adapter for setting the Active Directory OU for a user

Hi All
I created a pre-populate adapter that set the Active Directory OU for a user...
In the end the status of the resource is still showing "provisioning"..
It must be "Provsioned"..did I miss something ?
The logs speak as below :-
08:01:12,678 INFO [STDOUT] Running Create User
08:01:12,678 INFO [STDOUT] Before appending Root Context:OU=Human Resources,
08:01:12,678 INFO [STDOUT] tcUtilLDAPController.java : hierString : OU=Human Resources,dc=mydomain,dc=com
08:01:13,553 ERROR [ACTIVEDIRECTORYCONTROLLER] Problem creating object: javax.naming.OperationNotSupportedException: [LD
AP: error code 53 - 0000001F: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0
]; remaining name 'cn=ASYMONDS'
08:03:18,756 INFO [[xlWebApp]] action: LogonAction: User 'XELSYSADM' logged on in session 8116CBC0FA1481D06A207A1941B9
E096
08:22:31,256 ERROR [WEBAPP] Class/Method: ProvisionedResourcesForUserAction/confirmEnableSelection encounter some proble
ms: No checkbox was checked.

Just verify the OU value is correctly populated , first try doing the provisioning by manually giving OU and everything .
Is it successful ?
Then we can check if something wrong going with pre pop.
Thanks
Suren

Password security - set permissions for different users

I am using Abobe Acrobat 9 Pro.
In the HELP menu, there is a security section in the contents, In the overview, it states the following:
"Each security method offers a different set of benefits. However, they all allow you to specify encryption algorithms, select the document components to encrypt, and set permissions for different users."
I would like to know how you can set permissions for different users using Password Security.
I am the only one in the company who has Acrobat 9 Pro and all others have Adobe Reader 8.
I have created a PDF file in Acrobat 9, this file is accessible to anyone with Abobe Reader. I would like to set different permissions for different users. For example, i would like certain individuals to print the document and other individuals to not be allowed to print. Can this be acheived using Password Security?
Many Thanks

I have created a PDF file in Acrobat 9, this file is accessible to
anyone with Abobe Reader. I would like to set different permissions for
different users. For example, i would like certain individuals to print
the document and other individuals to not be allowed to print. Can this
be acheived using Password Security?
No.

Files to download without any permissions for guest user.

Hello, i have created a KM Navi Iview, with path to /documents/.../...
When i go to
http://portal/irj/portal/anonymous i see a list of files, but i can copy,delete and rename files (permissions for guest are: read), how can i solve this, if i need only download permissions for guest?

Hello Artem,
Please do not remove the Guest User from its groups.
The Guest User is an integral part of the "Anonymous Users" group which ultmately falls under "Everyone" Group. How did you remove Guest User as only Config tool allows you to do that.
What I suggest is make a Portal Group of Users and add all your regular users to it. Give Read/Write permission to this group. Then add only Read permissions for Anonymous Users Group.
Hope this helped.

GPO not working for new Users (Background)

Terminal Server 2012 in a hosted environment
I've set the below policy to set a default background wich can be changed by the users after this.
The target is an networkdrive. (The Reason behind this is that we have multiple resellers that all have the same networkdrive but pointing to a different store) Lets just say for this example that is P:/Background/ResellerBackground.jpg
The policy is Linked to the Resellers OU.
This works perfectly for all the existing users.
For new users this is not working at all. It does run the policy but it create the profile after running the policies.
So the above setting gets overruled by the default windows server 2012 background. The RunOnce atribute is set now, so it will not load it again.
I have read a lot of different sollutions so far, but none are working in this environment. (From changing the default Hive to changing the default picture etc)
One sollution came close, but not working perfectly either, this is removing the RunOnce atribute from the register, and letting the new users log in again. You do not wanna let new users login twice.
Before Windows 7/8/2012, in XP it just copied the default user and then the policies ran. So here the problem does not exist. Now it makes the profile after running the policies.
Anyone having an idea to resolve this issue?

Hi,
Before going further, what’s the value in the wallpaper registry entry
value data for new users?
>>One sollution came close, but not working perfectly either, this is removing the RunOnce atribute from the register, and letting the new users log in again. You
do not wanna let new users login twice.
If we choose this solution, we can try running cmd command
gpupdate/force to see whether it can work.
Another workaround is we can do it from scratch. We can create a new GPO to deploy wallpaper for these new users. The steps are the same as previous ones, just using
Security Filtering to apply this new GPO to new users, and unlinking and deleting the GPO after the policy getting updated.
Best regards,
Frank Shen

Is an iBooks Author tutorial available for new users?

Is an iBooks Author tutorial available for new users?

You can also try this site for video training on iBA. It's around $25/month for unlimted viewing and may be easier for some people than reading a manual:
http://www.lynda.com/iBooks-tutorials/iBooks-Author-Essential-Training/101460-2. html

How do i to totally reset iPad for new users?

How do i to totally reset iPad for new users?

Welcome to the Apple Support Communities
Open Settings > General > Reset > Erase All Content and Settings. After erasing your device, turn it off holding Sleep button

Portable Home Directory (PHD) not being created for new users

Creating users in the Workgroup Manager also created their home directories at the time I created it when we were using Leopard 10.5 server.
But now that it is upgraded to 10.6 server, it doesn't do anything when I create a new user and tell it to "Create Home Now".
Any idea how to fix this?

Assuming that the server is properly configured (most importantly DNS) try running sudo createhomedir -a
and see what that does. In my experience, clicking the create home now button doesn't always work.
See here for more info on this command.
http://support.apple.com/kb/TA21050?viewlocale=en_US
Note that this has worked for me on 10.3 to 10.5 Server - I've not tried it with 10.6.
Jeff

Wrong home directory permissions for new users

Similar Messages

Maybe you are looking for