Skip to main content

Chapter 5.4 - Best Practices

Learning Objectives​

By the end of this chapter, you will be able to:

  • Apply security best practices
  • Manage users securely
  • Understand the principle of least privilege
  • Implement password policies
  • Audit permissions

Principle of Least Privilege​

Concept​

Grant only the necessary permissions, nothing more.

Advantages:

  • Reduced attack surface
  • Limited damage in case of compromise
  • Security compliance

User Management​

Creation​

Best practices:

  • Create users with UID ≥ 1000
  • Dedicated primary group
  • Home directory with 700 permissions
  • Appropriate shell (not /bin/false for regular users)
# Good example
sudo useradd -m -s /bin/bash -u 1001 -g users user1
sudo chmod 700 /home/user1

Deletion​

Best practices:

  • Disable before deleting (usermod -L)
  • Backup important data
  • Check active processes
  • Clean directories and files
# Recommended process
sudo usermod -L user1      # Lock
sleep 30                   # Wait
sudo pkill -u user1        # Kill processes
sudo userdel -r user1      # Delete

Group Management​

Organization​

Best practices:

  • Groups by project/team
  • Groups by function (developers, admins)
  • Avoid overly broad groups
  • Document groups
# Organization example
sudo groupadd projet-alpha
sudo groupadd developers
sudo groupadd admins

Members​

Best practices:

  • Add only necessary users
  • Regularly review members
  • Remove inactive users
  • Document additions

Passwords​

Policy​

Configuration in /etc/login.defs:

# Minimum duration (days)
PASS_MIN_DAYS 1

# Maximum duration (days)
PASS_MAX_DAYS 90

# Warning (days before expiration)
PASS_WARN_AGE 7

Complexity​

Configuration with PAM:

# /etc/pam.d/common-password (Ubuntu/Debian)
password requisite pam_pwquality.so retry=3 minlen=8 difok=3

Requirements:

  • Minimum length (8+ characters)
  • Complexity (uppercase, lowercase, numbers, symbols)
  • No dictionary words
  • No repetition

Expiration​

# Force change at next login
sudo chage -d 0 user1

# Set expiration
sudo chage -E 2024-12-31 user1

# View information
chage -l user1

File Permissions​

System Directories​

Best practices:

  • /etc: 755 (root:root)
  • /bin, /sbin: 755 (root:root)
  • /home: 755 (root:root)
  • /home/user: 700 (user:user)
  • /tmp: 1777 (root:root, sticky bit)

Configuration Files​

Best practices:

  • Restrictive permissions (600-644)
  • Owner root or service
  • No execution unless necessary
# Example
sudo chmod 600 /etc/shadow
sudo chmod 644 /etc/passwd
sudo chmod 640 /etc/group

Use of sudo​

Configuration​

Best practices:

  • Use sudo instead of direct root
  • Limit allowed commands
  • Log actions
  • Appropriate timeout
# /etc/sudoers
# Grant full access
user1 ALL=(ALL:ALL) ALL

# Limit to specific commands
user1 ALL=(ALL) /usr/bin/systemctl, /usr/bin/docker

# Without password (caution!)
user1 ALL=(ALL) NOPASSWD: ALL

Verification​

# View sudo privileges
sudo -l

# View history
sudo cat /var/log/auth.log | grep sudo

Audit and Monitoring​

Check Permissions​

# Files with broad permissions
find /home -type f -perm -o+w

# SUID/SGID files
find / -type f -perm /4000  # SUID
find / -type f -perm /2000  # SGID

# World-writable directories
find / -type d -perm -o+w

Connection Monitoring​

# Connected users
who
w

# Connection history
last
lastlog

# Failed attempts
sudo grep "Failed password" /var/log/auth.log

Root Security​

Best Practices​

Never:

  • Connect directly as root
  • Share root account
  • Use root for normal tasks

Always:

  • Use sudo
  • Limit root access
  • Log root actions
  • Change root password regularly

Summary​

In this chapter, you learned:

Least privilege: Grant only necessary permissions
Users: Secure creation, clean deletion
Groups: Logical organization, controlled members
Passwords: Strong policy, expiration
Permissions: Restrictive, regular audit
sudo: Appropriate configuration, logging
Audit: Regular checks, monitoring

Next Steps​

Module 6: Shell Scripting (with crons)
Module 7: Network and Configuration

Chapter created on: December 2024