Topic 5: Security and File Permissions

UID

User Identifier, an enumerated reference to a user account

GID

Group Identifier, an enumerated reference to a group account

primary GID

the default group a user has

Superuser

another name for the root user. Has a UID of 0

Standard User Accounts

Can't change system settings and can store files in their designated area only

System Accounts

Organized way of naming and categorizing accounts with no defined shell and limited or no privileges

Service Accounts

Accounts used to provide privileged access used by system services and core applications. Very similar or interchangable with System accounts

login shell

The shell that is opened directly after a user has logged in.

chsh

changes the login shell

id

list the current information of a user

last

listing the last time users have logged into the system

who

lists active logins on a system

su

switch user, but not often used. Most commonly used as su - which switches to user

sudo

run command as root

/etc/passwd

stores basic information about users on the system, including UID, GID, home directory, shell, etc. (no actual passwords)

USERNAME:PASSWORD:UID:GID:GECOS:HOMEDIR:SHELL

Password is generally x, meaning password is in shadow.

GECOS

A field in the /etc/passwd file that can be used to store personal data about a user on the Linux operating system. GECOS originally stood for General Electric Comprehensive Operating Supervisor. Generally has name, location, contact info.

/etc/group

stores all basic information about user groups

NAME:PASSWORD:GID:MEMBERS

(password usually x/in gshadow)

/etc/shadow

stores user passwords. Hashed, for security

USERNAME:PASSWORD:LASTCHANGE:MINAGE:MAXAGE:WARN:INACTIVE:EXPDATE

etc/gshadow

contains more detailed and secure group account information

NAME:PASSWORD:ADMINISTRATORS:MEMBERS

/etc/sudoers

file used to determine which users can use the sudo command to execute commands as other users and how

/etc/sudoers.d

directory containing files to supplement sudoers settings

chfn

change the GECOS information

useradd

adds a new user

options:

-c (comments)

-d (custom home directory)

-f (sets # of days after password expires to update)

-g (specific GID)

-G (adding it to multiple secondary groups)

-m (new account with home directory)

-M (new account without home directory)

-s (specific shell)

-u (specific UID)

passwd

Modify a user password

options (available only to root):

-d deletes password/makes it no password required

-e force the user to change the password

-l lock the user account

-u unlock the user account

-S output info about the password status

userdel

delete a user account. Adding -r also removes the user's home directory and contents

/etc/skel

A directory that contains files that are copied to all new users' home directories upon creation.

groupadd

adds a group

-g creates a specific GID

groupdel

deletes the group

file permissions

every file on the disk is owned by: a user, a group. Each file has three permissions: for user, for group, and for everybody else

file permission listing

drwxr-xr--

d rwx r-x r--

optional first character: file type (d is for directory)

next three: permissions of owner

next three: permissions of group

last three: permissions of other

r: read (octal 4)

w: write (octal 2)

x: execute (octal 1)

-:not allowed

ls -l

permissions, number of hard links, user, group, filesize, timestamp, file name

ls -li

inode number, permissions etc

file type abbreviations

there are several:

-: normal file

d: directory

l: soft link (pointer)

b: block device (virtual or physical block device, usually a disk)

c: character device (virtual or physical character device, like a terminal)

s: socket (a conduit passing info between programs)

chmod

used to change permissions for a file. Takes 2+ parameters: which permissions to change, file to change

add -R to change all files within and including a directory

chmod symbolic notation

ug+rw-x,o-rwx text.txt

This sets user/group permissions to rw-, and other to ---

first characters: which permissions altering? u (user) g (group) o (others) a (all)

second: what to change? grant permission (+), revoke permission (-), set permission (=)

last: what permission to affect? read (r), write (w), execute (x), etc

+t adds sticky bit, or other special with their letter

chmod numeric mode

r: 4; w: 2; x: 1, -: 0 (special t: 1)

add them up, one digit per item

user rwx 7

group r-x 6

others r-- 4

so: chmod 764 filename.txt

(for special permissions, add them at the beginning

chmod 5765 directoryname

d rws r-x r-t)

$ chown username:groupname filename

changes ownership of a file/directory

Note: the owning user doesn't need to be in the group that owns the file

$ chown username filename

$ chown :groupname filename

$ chgrp groupname filename

are also acceptable

$ groups

gets a list of groups on the system

$ sudo groupmems -g groupname -l

groupmems (must be run as root) displays which users belong to a group. -g specifies the group, and -l lists the members

sticky bit

restricted deletion flag. On directories. Stops users from removing or renaming a file in a directory unless they own that file or directory. octal value of 1, only applies to 'others'

Set GID

also known as SGID or Set Group ID bit

octal value of 2

represented by an s on group permissions (rws)

On executables: gives the process resulting from execution the privileges of the group owning the file (e.g. if the group can read information.txt, the process can as well)

On directories: makes all files created in the directory owned by the group who owns the directory (as opposed to the default group of the creator)

Set UID

also known as SUID or Set User ID

octal value of 4

represented by an s on user permissions (rws)

applies only to files! executable runs with the privileges of the USER

temporary files

Files temporarily written by an application to perform a function

/tmp

temporary files that are recommended to be deleted during boot-up

/var/tmp

temporary files that are NOT cleared during boot-up

/run (sometimes /var/run)

contains run-time data used by running processes (such as process identifier files .pid)

MUST BE cleared on boot-up

temporary file permissions

typically:

d rwx rwx rwt

STICKY BIT: the owners can do anything, but only to files they own

Symbolic link

aka soft link; points to the path to another file or directory. Think of it like a hyperlink--brings you there

(fun note: permissions look like (lrwxrwxrwx))

can be renamed

If created with a FULL/ABSOLUTE PATH then they can be moved. If not, moving will BREAK THE LINK

Hard link

Creates another 'file' that links to the target. Works only on files. Think of it as another name for the file.

Either can be renamed or moved without breaking the link.

Editing it changes the file. (note: because of specific reasons, deleting one does NOT delete the file)

ln

$ ln TARGET LINK_NAME

target must already exist. If the target is not on the current directory, or if you want the link elsewhere, you need to specify a full path to it

if there's no linkname, a link with the file name appears on the same directory

-s flag creates a soft link

inode number

Corresponds to the location of the file's contents (the data in the file); the file name links to the inode number.