User home directory permission issue

I’m managing the users and groups via Google Cloud Identity. And on GCP I assigned roles to the user groups created on Google Admin Console so I don’t have to manually add new members on GCP IAM individually. The problem I’m having now is subdirectories for specific users are created as they log in via OS Login for the first time. But the home directory of each user is set to “drwxr-xr-x.”, which can be accessed by other users from other groups. I checked the UMASK is 077 in the /etc/login.defs, which should be good.

How should I control the access permission between user home directories to prevent users from messing up others’ home directories?

The hard to do part is the user’s home directory is only created the first time they login via OS Login.

Thanks!

[yuanzhou]

Update

So I created a new project and installed the slurm cluster. I logged into the controller node and the login node using the admin account, added the “umask=0077” to the /etc/pam.d/sshd as you suggested. Then added new users to IAM and tested again. All new users’ home directories now have the correct permission on both controller node and the login node!

I don’t know why my old GCP project didn’t work, but the new project proofed the solution! Thank you so much for your help!

[yuanzhou]

In my use case, all the VM instances are created with CentOS 7 image from Google. And this is what I get after the change:

“joe_yuan_midasnetwork_us” is the new user logged after adding the umask change. We’ll have lots of users to use the cluster via OS Login. And the /home is mounted to NFS filestore instance.