Lab 3.5 - Permission Management

Objectives

By the end of this lab, you will be able to:

• Understand the importance of permissions in a Linux system
• Create users and configure shared files
• Apply appropriate permissions with chmod and chown
• Use symbolic notation of chmod (u, g, o, a)
• Verify and test permissions
• Understand the differences between useradd and adduser

---

Prerequisites

• Ubuntu 24.04 installed and operational
• Root or sudo access
• Open terminal

---

Reminder on Permission Management

Permission management is an essential aspect of Linux system administration. It allows you to control who can access, modify, or execute files and directories. Poorly configured permissions can lead to major security breaches, compromising data confidentiality, integrity, and availability.

In this section, we will explore the different steps necessary to create users, configure shared files and directories, and apply appropriate permissions to ensure controlled access. We will also see how to verify these permissions to ensure they are correctly applied.

The exercises presented will help you understand how the chown, chmod, and su commands can be used to effectively manage access, as well as the potential risks associated with poor configuration.

---

Exercise 1: Initial Permission Configuration

Step 1: Log in as Superuser

# On Ubuntu 24.04, use sudo instead of su
sudo su
# Or use sudo directly for each command

Step 2: User Creation

# On Ubuntu 24.04, use adduser (more user-friendly) or useradd
sudo adduser albert
sudo adduser bernard
sudo adduser claude
sudo adduser danielle

# If adduser is not available, use useradd with -m to create the home
# sudo useradd -m albert
# sudo passwd albert  # Set the password

Note: On Ubuntu 24.04, adduser is preferred because it is interactive and automatically configures the home directory and other settings.

Step 3: Creating the Folder and Files

# Create the shared_data folder and necessary subfolders/files
sudo mkdir -p /home/shared_data
sudo mkdir -p /home/shared_data/dossier1

sudo touch /home/shared_data/file1.txt
sudo touch /home/shared_data/file2.txt
sudo touch /home/shared_data/dossier1/script1.sh
sudo touch /home/shared_data/dossier1/script2.sh

# Add content to the scripts for testing
echo '#!/bin/bash
echo "Script 1 executed"' | sudo tee /home/shared_data/dossier1/script1.sh

echo '#!/bin/bash
echo "Script 2 executed"' | sudo tee /home/shared_data/dossier1/script2.sh

Step 4: Assigning Owners and Permissions

# Initial configuration of permissions and owners

# Albert - owner of file1.txt with permissions 644 (rw-r--r--)
sudo chown albert:albert /home/shared_data/file1.txt
sudo chmod 644 /home/shared_data/file1.txt

# Albert - owner of file2.txt with permissions 444 (r--r--r--) - read-only
sudo chown albert:albert /home/shared_data/file2.txt
sudo chmod 444 /home/shared_data/file2.txt

# Bernard - owner of file2.txt with permissions 664 (rw-rw-r--)
sudo chown bernard:bernard /home/shared_data/file2.txt
sudo chmod 664 /home/shared_data/file2.txt

# Bernard - owner of script1.sh with permissions 751 (rwxr-x--x)
sudo chown bernard:bernard /home/shared_data/dossier1/script1.sh
sudo chmod 751 /home/shared_data/dossier1/script1.sh

# Claude - recursive owner of dossier1 with permissions 766 (rwxrw-rw-)
sudo chown -R claude:claude /home/shared_data/dossier1
sudo chmod 766 /home/shared_data/dossier1
sudo chmod 666 /home/shared_data/dossier1/script1.sh
sudo chmod 666 /home/shared_data/dossier1/script2.sh

# Danielle - recursive owner of shared_data with permissions 777 (rwxrwxrwx) - ALL RIGHTS
sudo chown -R danielle:danielle /home/shared_data
sudo chmod -R 777 /home/shared_data

Step 5: Verification of User Home Directories

# Verify that user directories are correctly configured
ls -l /home

# Verify permissions of the shared_data folder
ls -lR /home/shared_data

---

Exercise 2: Permission Tests

Permission Test Table

Here is a table describing the actions each user will attempt and the expected results based on the defined permissions:

Action/Test	User	Command	Expected Result
Read file1.txt	Albert	cat /home/shared_data/file1.txt	Success
Write to file1.txt	Albert	echo "Test" >> /home/shared_data/file1.txt	Success
Read file2.txt	Albert	cat /home/shared_data/file2.txt	Success
Write to file2.txt	Albert	echo "Test" >> /home/shared_data/file2.txt	Failure (Permission denied)
Read and write to file2.txt	Bernard	echo "Bernard" >> /home/shared_data/file2.txt	Success
Execute script1.sh in dossier1	Bernard	bash /home/shared_data/dossier1/script1.sh	Success
Read and write in dossier1	Claude	echo "Claude" >> /home/shared_data/dossier1/test.txt	Success
Execute script1.sh in dossier1	Claude	bash /home/shared_data/dossier1/script1.sh	Failure (Permission denied)
Perform all actions on all files/directories	Danielle	echo "Danielle" >> /home/shared_data/file1.txt	Success (full access)

Performing the Tests

# Run the tests to verify permissions

# Test 1: Albert reads file1.txt
sudo su albert -c 'cat /home/shared_data/file1.txt'

# Test 2: Albert writes to file1.txt
sudo su albert -c 'echo "Test Albert" >> /home/shared_data/file1.txt'

# Test 3: Albert reads file2.txt
sudo su albert -c 'cat /home/shared_data/file2.txt'

# Test 4: Albert tries to write to file2.txt (should fail)
sudo su albert -c 'echo "Test" >> /home/shared_data/file2.txt' || echo "Expected failure: Permission denied"

# Test 5: Bernard writes to file2.txt
sudo su bernard -c 'echo "Bernard" >> /home/shared_data/file2.txt'

# Test 6: Bernard executes script1.sh
sudo su bernard -c 'bash /home/shared_data/dossier1/script1.sh'

# Test 7: Claude writes in dossier1
sudo su claude -c 'echo "Claude" >> /home/shared_data/dossier1/test.txt'

# Test 8: Claude tries to execute script1.sh (should fail)
sudo su claude -c 'bash /home/shared_data/dossier1/script1.sh' || echo "Expected failure: Permission denied"

# Test 9: Danielle writes to file1.txt (full access)
sudo su danielle -c 'echo "Danielle" >> /home/shared_data/file1.txt'

# Verify the results
cat /home/shared_data/file1.txt
cat /home/shared_data/file2.txt
ls -l /home/shared_data/dossier1/

---

Exercise 3: Symbolic Notation with chmod

In this exercise, you will explore execution permissions and how to grant them to users, groups, and others using the symbolic notation of chmod.

Educational Objectives

• Understand symbolic notation (u, g, o, a) with chmod
• Dynamically add execution permission without modifying other rights
• Verify effects with ls -l

Step 1: Create a Simple Script File

# Create a test script
touch mon_script.sh
echo -e "#!/bin/bash\necho 'Script launched!'" > mon_script.sh

# Verify the content
cat mon_script.sh

Step 2: Display Current Permissions

ls -l mon_script.sh

Verify that the file is not executable (no x in the permissions).

Step 3: Add Execution Permission for the User (Owner)

chmod u+x mon_script.sh
ls -l mon_script.sh

Then, try to execute the script with:

./mon_script.sh

Step 4: Add Execution Permission for the Group

chmod g+x mon_script.sh
ls -l mon_script.sh

Step 5: Add Execution Permission for All Users (a = all)

chmod a+x mon_script.sh
ls -l mon_script.sh

Step 6: Remove All Execution Permissions

chmod a-x mon_script.sh
ls -l mon_script.sh

Summary of Commands Used

Command	Action
chmod u+x file	Adds execution permission for the user
chmod g+x file	Adds execution permission for the group
chmod o+x file	Adds execution permission for others
chmod a+x file	Adds execution permission for everyone
chmod a-x file	Removes execution permission for everyone

Reflection Questions

1. Why do we sometimes use u+x instead of chmod 744?
2. Is it possible to add a permission without affecting others? Explain.
3. What is the difference between chmod a+x and chmod 755?

---

Appendix 1: useradd vs adduser

Creating Users with useradd and adduser

User management is a fundamental task in Linux system administration. Two main commands are commonly used to create users: useradd and adduser. Although they have similar names, they function differently.

useradd: The Basic Command

The useradd command is a standard utility available on all Linux distributions. It allows you to create a new user without human interaction, making it ideal for automation scripts. However, useradd does not prompt for a password or additional information by default.

# Create a user without a password
sudo useradd -m albert

After creating the user, you must manually set a password with the passwd command:

# Add a password for the user
sudo passwd albert

adduser: The User-Friendly Version

On some Linux distributions, like Debian and Ubuntu, adduser is a more user-friendly command, which is actually a Perl script wrapping useradd. This command guides the administrator through an interactive process where they can configure several aspects of the user account, including the password, full name, and other optional information.

# Create a user with an interactive process
sudo adduser albert

The system will ask you a series of questions:

1. Password: You will be prompted to enter and confirm the user's password.
2. Full Name: You can provide a full name for the user (optional).
3. Room Number, Work Phone, Home Phone, Other Information: These fields are optional and can be left blank by pressing Enter.
4. Confirmation: You will need to confirm the information before the user is created.

When to Use useradd or adduser?

• useradd: Use this command when you need to create users via a script or when you do not want to be prompted for additional information.
• adduser: Use this command when you prefer an interactive process and want to configure multiple account details in one step.

---

Appendix 2: Password Management

Add a Password After Creation with useradd

When you use the useradd command, by default, it does not prompt you to create a password for the user. To add a password immediately after creating a user, you can use the passwd command.

# Create users
sudo useradd -m pierre
sudo useradd -m marie
sudo useradd -m luc
sudo useradd -m sophie

# Add a password for each user
sudo passwd pierre
sudo passwd marie
sudo passwd luc
sudo passwd sophie

With each passwd command, the system will prompt you to enter a password for the specified user. Ensure that the password complies with the system's security rules (e.g., minimum length, complexity, etc.).

Change a User's Password

To change the password for the user luc, you can use the following command:

sudo passwd luc

After executing this command, the system will prompt you to enter a new password for the user luc, then confirm it by entering it a second time.

---

Reflection Questions

Objective

Better understand permission management in Linux and the impact of these configurations on the overall security of the system.

1. Explain the importance of permissions in a Linux system. How can incorrect permissions affect a system's security?

   • This question aims to get you to think about security implications and access management in a Linux environment.

2. What are the differences between read, write, and execute permissions? Why is it crucial to configure these permissions correctly in a multi-user environment?

   • This question is designed to help you understand and explain the importance of each type of permission in a system's security and functionality.

3. What is the role of the sudoers file in system permission management? How can a misconfiguration of this file compromise a Linux system?

   • This question encourages you to explore the critical role of the sudoers file in managing administrative privileges and the risks associated with its mismanagement.

4. Why is it important to limit execution permissions on certain files or scripts? Provide an example where this limitation could prevent a security breach.

   • This question allows you to discuss the importance of restricting execution permissions and to think about scenarios where such restrictions are essential to security.

5. How do the chmod and chown commands influence the security of files and directories on a Linux server? What are the best practices for their use?

   • This question asks you to describe how these commands affect the security of files and directories and to reflect on best practices for their effective and safe use.

6. Consider a scenario where a user accidentally obtained excessive permissions on critical files. What could be the consequences and how could this problem be resolved?

   • This question aims to make you think about the potential impacts of over-assigning permissions and possible corrective measures.

7. What is the "sticky bit" and how can it be used to enhance the security of shared directories?

   • This question encourages you to explore the concept of the sticky bit, its usefulness, and its application in securing environments where multiple users access the same directories.

8. Discuss the importance of separating user and administrator rights on a Linux system. How does this influence the overall security of the system?

   • This question allows you to reflect on the importance of privilege separation in preventing rights abuse and accidental errors.

---

Summary

In this lab, you learned to:

• Create users with adduser and useradd
• Configure shared files and directories
• Apply permissions with chmod (numeric and symbolic notation)
• Change owners with chown
• Test and verify permissions
• Understand the importance of permission security

---

Next Steps

• Lab 3.2: Permission Management (basic concepts)
• Module 5: Users and Permissions (advanced)
• Module 9: System Security (advanced security)

---

Lab created on: December 2024