File security on Niflheim

Overview

According to DTU’s IT security policies, user home directories are personal and private, and you are not permitted to access in any way the directories of other users, even if file permissions would make this technically possible.

In light of the possibilities to use AI for automated espionage/snooping we need to reconsider the amount of openness on Niflheim. Three models of file security can fairly easily be implemented as discussed below.

On Niflheim we recommend model 2. The GROUP model as a convenient compromise between security and ease of use. However, each research section should decide which model is appropriate for them in view of the sensitivity of their data, and the section leader should take responsibility for the decision.

Please contact the Niflheim support if you would like further advice.

1. The OPEN model (the current default)

Any user of Niflheim can read your files, as part of a collaboration, or with more nefarious purposes. Specific folders can be protected further if desired.

All files are readable by everyone, except for a few sensitive folders where the application software by default locks down files.

2. The GROUP model

People in the same Unix_group as yourself can read your files. You can view your own userid (uid), groupid (gid) and Unix_group memberships with the id command. Within this model:

Everyone can read the files of other users in the same Unix_group.
Faculty, postdocs and Ph.D students are members of a Unix_group named xxxvip and can read this group’s files.

They can also read the M.Sc./B.Sc. students’ files, if they are made secondary members of (added to) the xxxstud Unix_group.
M.Sc./B.Sc. students cannot read the files of the researchers, unless the specific folders are opened up.

In the above xxx refers to your research section abbreviation.

3. The PARANOID model

Noone else can read your files.

Special access in the GROUP and PARANOID models

It is possible to open specific folders for access by either your Unix_group, or by everyone.

Discussion point

What should be the default security model at Niflheim? Individual users can override this if they so desire.

Warning

Encrypt any files containing real secrets! If somebody gains root access to a computer that can mount Niflheim folders, they can access all your files!

Technical stuff

We recommend contacting Niflheim support to set stuff up as you desire. Below is the do-it-yourself description.

Implementing the OPEN, GROUP and PARANOID models without exceptions

This is done by setting the appropriate permissions on your home folder. If you do not need to have any open folders, locking down your home folder is sufficient. But if you want to open specific subfolders you have to do a bit more work, see below.

Within the above 3 models you set the appropriate permission of your home folder with the chmod_command:

chmod og=rx $HOME     # 1. Open model, permission -rwxr-xr-x
chmod g=rx,o= $HOME   # 2. Group model, permission -rwxr-x---
chmod og= $HOME       # 3. Paranoid model, permission -rwx------

Note: the g and/or o in the permission string sets up permissions for your group and for other users.

Use the ls_command to view your folders:

ls -l $HOME

Closing specific folders in the OPEN or GROUP models

You can always close off a folder so it is either private-only, or only accessible to your group. You do that by:

chmod g=rx,o= folder  # Only the group can read/list the folder
chmod og= folder      # Nobody can access the folder

Giving students access in the GROUP model

If you are in group xxxvip you may want to make a specific folder readable by the Unix_group xxxstud.

First you need to give execute access but no read access to your home folder, and then people can access a file or folder if they know its name AND have permissions to the file/folder, but they cannot list your file names. Then you lock down all subfolders and files in your home folder. Finally, you can open the specific folder.

Warning

This recipe only partly locks your home folder, as people still have execute access to it. This means that while people cannot run ls on your home folder, they can read some metadata about files and folders if they can guess the file names (they can stat the file). An AI can make very qualified guesses about file names! But only top-level folder names and file names can be verified in this way.

PLEASE NOTE: If this is not acceptable, the only solution is to store the shared folder on a separate file system from your home folder.

Make your home folder accessible but not listable (i.e., contents cannot be seen) for users outside xxxvip:

chmod o=x $HOME

Lock down all files and folders in your home folder:

chmod o= $HOME/* $HOME/.??*

Make sure that any new files/folders created are also locked down by adding a umask_command line to your .bashrc file:

umask 0027
- or using symbolic notation -
umask u=rwx,g=rx,o=

Now you need to open your folder (in this example named shared) with the desired permissions:

To make the folder readable by members of the group xxxstud it must be assigned to that group, and the setgid_bit must be set so files in the folder are also assigned to the group:
```
chgrp -R xxxstud shared
chmod g=rxs,o= shared
```
Files and subfolders created in shared, or copied there with the cp_command, will belong to the xxxstud Unix_group, but files moved there (with the mv_command) need to have their group changed with the chgrp_command before they become readable by xxxstud.
To make a folder, subfolders or files readable by everyone, the folder and all its subfolders should be given read and execute permissions for everyone, and all files should be given read permission for everyone by using the find_command:
```
chmod og+rx folder
find folder -type f -exec chmod og+r {} +
find folder -type d -exec chmod og+rx {} +
```