Lab 1 – Permission Management and Linux Environment Customization

Correction Elements

Correction elements for this lab are available in the exercise repository: 👉 module-13 – Corrections

General Objective

Understand, apply, and test Unix permissions (chmod, chown, su) in a multi-user environment.
Learn to customize a user environment with .bashrc.

---

Duration

1 week

Deliverable

• A PDF or Word report with screenshots, explanations, and reflections
• Scripts or commands used (in the report and in a .sh file if applicable)

---

Context

You are the administrator of a Linux server used by 4 colleagues: Albert, Bernard, Claude, and Danielle.
You must:

• Create the users: Albert, Bernard, Claude, and Danielle
• Prepare a common workspace
• Assign specific permissions
• Test the expected actions
• Add a personal touch to their environment with animated welcome messages

---

PART 1 – Granting Administrator Rights to the eleve User

Context

In this lab, you mainly work with the eleve user. It is possible that this user has already been created during the installation of Ubuntu 24.04. If not, you must create it manually.

Task

Create the user eleve with the password eleve
(if not already done during the installation of Ubuntu 24.04).
Then, add this user to the sudo group so that they can execute administrative commands.

Commands to Complete

Command 1.1 : ___________________________________________   # Create the user eleve with the password eleve (if necessary)
Command 1.2 : ___________________________________________   # Add the user eleve to the sudo group
Command 1.3 : ___________________________________________   # Open the sudoers file with the secure tool
Command 1.4 : ___________________________________________   # Check or add the line allowing eleve to use sudo
Command 1.5 : ___________________________________________   # Test a command with sudo (e.g., sudo ls /root)

Expected Result

• The eleve user exists and can log in with their password
• They can execute commands with sudo (password required)
• No error message when executing a sudo command

Required Screenshots

1. Creation of the eleve user (if necessary)
2. Addition to the sudo group
3. Content of the modified or verified sudoers file
4. Successful test of a command with sudo

---

PART 2 – Creating Users and Changing Their Passwords

Context

You are now logged in as eleve or root, who have sudo rights. You must:

• Create four users: albert, bernard, claude, danielle
• Set an initial password during creation (note it down)
• Verify that their home directories are created
• Test login with su -
• Change their passwords from your eleve account

Commands to Complete

Command 2.1 : ___________________________________________   # Create the user albert (indicate the password used)
Command 2.2 : ___________________________________________   # Create the user bernard (password to note)
Command 2.3 : ___________________________________________   # Create the user claude (password to note)
Command 2.4 : ___________________________________________   # Create the user danielle (password to note)
Command 2.5 : ___________________________________________   # Display directories in /home to verify creations
Command 2.6 : ___________________________________________   # Log in with su - albert, then return to eleve
Command 2.7 : ___________________________________________   # Change the password of the user albert from eleve
Command 2.8 : ___________________________________________   # Change the password of the user bernard from eleve
Command 2.9 : ___________________________________________   # Change the password of the user claude from eleve
Command 2.10 : __________________________________________  # Change the password of the user danielle from eleve

Expected Result

• User directories appear in /home
• su - albert allows logging into their session
• All passwords have been successfully changed from eleve

Required Screenshots

1. Output of the ls /home command
2. Successful login to albert's session then return
3. Password changes for the 4 users

---

PART 3 – Adding Danielle and Claude to sudoers

Context

You are logged in with the eleve user (or root) who has sudo rights.
You must now grant administrator rights to Danielle and Claude by adding them to the sudoers file.

This will allow them to execute critical commands with sudo, such as system updates, user account modifications, or system file management.

Objectives

• Add claude and danielle to the sudoers file
• Verify that they can both execute commands with sudo

Commands to Complete

Command 3.1 : ___________________________________________   # Open the sudoers file with visudo
Command 3.2 : ___________________________________________   # Add a line allowing claude to execute sudo commands
Command 3.3 : ___________________________________________   # Add a line allowing danielle to execute sudo commands
Command 3.4 : ___________________________________________   # Verify that claude belongs to the sudo group OR is listed in /etc/sudoers
Command 3.5 : ___________________________________________   # Verify that danielle belongs to the sudo group OR is listed in /etc/sudoers
Command 3.6 : ___________________________________________   # Log in with the user claude
Command 3.7 : ___________________________________________   # Execute a command with sudo (e.g., sudo whoami) to test
Command 3.8 : ___________________________________________   # Log in with the user danielle
Command 3.9 : ___________________________________________   # Execute a command with sudo to test

Expected Result

• Claude and Danielle appear in the /etc/sudoers file, or are part of a group (e.g., sudo) granting them administrative rights
• When testing a command with sudo, they are prompted to enter their password, and the command executes correctly
• No error message related to insufficient permissions should appear

Required Screenshots

1. Display of the added lines in the sudoers file
2. Successful execution of a command with sudo for Claude
3. Successful execution of a command with sudo for Danielle

---

PART 4 – Preparing a Shared Directory

Context

You must create a shared directory located in /home/shared_data/, with a precise structure of files and subfolders.
Two .sh scripts must also be created with a message displayed upon execution.

Expected User for This Part

This part must be performed as root or as the eleve user with sudo rights.

Therefore, use the sudo command before each command if you are logged in with eleve.

Objectives

• Create the complete directory structure in /home/shared_data
• Write the content of two simple scripts
• Verify the correct creation of files and folders

Expected Structure

/home/shared_data/
├── file1.txt
├── file2.txt
└── folder1/
    ├── script1.sh
    └── script2.sh

Expected Content for script1.sh

#!/bin/bash
echo "Hello from script 1!"

Expected Content for script2.sh

#!/bin/bash
echo "Hello from script 2!"

Commands to Complete

Command 4.1 : ___________________________________________   # Create the folder /home/shared_data
Command 4.2 : ___________________________________________   # Create the file file1.txt
Command 4.3 : ___________________________________________   # Create the file file2.txt
Command 4.4 : ___________________________________________   # Create the subfolder folder1
Command 4.5 : ___________________________________________   # Create the file script1.sh in folder1
Command 4.6 : ___________________________________________   # Create the file script2.sh in folder1
Command 4.7 : ___________________________________________   # Write the content into script1.sh
Command 4.8 : ___________________________________________   # Write the content into script2.sh
Command 4.9 : ___________________________________________   # Verify the entire structure with ls -R or tree

Expected Result

• The /home/shared_data/ directory contains two text files and a subfolder folder1/
• The subfolder contains two .sh scripts with correct content
• The ls -R (or tree) command reflects exactly the expected structure

Required Screenshots

1. Output of the ls -R /home/shared_data or tree /home/shared_data
2. Display of the content of script1.sh and script2.sh with cat

---

PART 5 – Assigning Permissions

Context

You have created a shared file structure in /home/shared_data.
You must now assign specific owners and permissions to each element to ensure controlled access.

Expected User

This part must be performed as root or with the eleve user having sudo rights.
All commands in this section must therefore be executed with the necessary privileges.

Objectives

Assign the following owners and permissions:

File / Folder	Owner	Expected Permissions
/home/shared_data/file1.txt	albert	Read/write for him only
/home/shared_data/file2.txt	bernard	Read/write for him only
/home/shared_data/folder1/script1.sh	bernard	Executable only by Bernard
/home/shared_data/folder1/script2.sh	claude	Modifiable (read/write) but not executable
/home/shared_data/	danielle	Full control over the entire folder (complete access)

Commands to Complete

Command 5.1 : ___________________________________________   # Change the owner of file1.txt to albert
Command 5.2 : ___________________________________________   # Apply read/write permissions for albert only
Command 5.3 : ___________________________________________   # Change the owner of file2.txt to bernard
Command 5.4 : ___________________________________________   # Apply read/write permissions for bernard only
Command 5.5 : ___________________________________________   # Change the owner of script1.sh to bernard
Command 5.6 : ___________________________________________   # Apply execution-only permissions for the owner
Command 5.7 : ___________________________________________   # Change the owner of script2.sh to claude
Command 5.8 : ___________________________________________   # Apply read/write permissions without execution
Command 5.9 : ___________________________________________   # Recursively change the owner of the shared_data folder to danielle
Command 5.10 : __________________________________________  # Give danielle all rights on all files in the folder
Command 5.11 : __________________________________________  # Verify permissions with ls -l /home/shared_data and subfolders

Expected Result

• Each file has the correctly assigned owner
• Permissions (r, w, x) are applied exactly as requested
• The ls -l command on each file should show these rights

Required Screenshots

1. Output of the ls -l /home/shared_data/
2. Output of the ls -l /home/shared_data/folder1/
3. Any other useful proof you deem relevant

---

PART 6 – User Access Test Table

Context

Permissions have been assigned. It is now time to test the access of each user to the files and scripts in the /home/shared_data directory.

For each test, you must temporarily log in with a user via the command:

su -c 'command to execute' username

Objectives

• Verify that access rights work as expected
• Document the observed results for each test
• Identify successes or permission errors

Commands to Complete

So for each user, test the following actions with su username -c 'command':

Command 6.1 : ___________________________________________   # Albert attempts to read file1.txt
Command 6.2 : ___________________________________________   # Albert attempts to write to file1.txt
Command 6.3 : ___________________________________________   # Albert attempts to write to file2.txt
Command 6.4 : ___________________________________________   # Bernard writes to file2.txt
Command 6.5 : ___________________________________________   # Bernard executes script1.sh
Command 6.6 : ___________________________________________   # Claude modifies script2.sh (e.g., adds a line)
Command 6.7 : ___________________________________________   # Claude attempts to execute script1.sh
Command 6.8 : ___________________________________________   # Danielle modifies file1.txt
Command 6.9 : ___________________________________________   # Danielle modifies script2.sh

Expected Result for Each Command

Test	Expected Result
Albert reads file1.txt	Success
Albert writes to file1.txt	Success
Albert writes to file2.txt	Failure (permission denied)
Bernard writes to file2.txt	Success
Bernard executes script1.sh	Success
Claude modifies script2.sh	Success
Claude executes script1.sh	Failure (permission denied)
Danielle modifies file1.txt	Success
Danielle modifies script2.sh	Success

Required Screenshots

• Execution of each test with su -c
• Success or error messages displayed by the system
• (For example: Permission denied or generated content display)

---

PART 7 – Customizing the .bashrc Environment

Context

Each user of your system must have a personalized message or a visual effect that displays when they open a session (login with su - username).
This is done by modifying the .bashrc file present in each user's home directory.

You will modify this file for each of the 4 created users.

Objectives

• Add personalized content in each user's .bashrc
• Use at least one of the following commands:
  • figlet (stylized ASCII display)
  • cowsay (message in a bubble with a cow)
  • fortune (random quote)
  • echo (simple message)
• Verify that it works upon session login

Commands to Complete

Command 7.1 : ___________________________________________   # Add a personalized message in albert's .bashrc
Command 7.2 : ___________________________________________   # Add a personalized message in bernard's .bashrc
Command 7.3 : ___________________________________________   # Add a personalized message in claude's .bashrc
Command 7.4 : ___________________________________________   # Add a personalized message in danielle's .bashrc
Command 7.5 : ___________________________________________   # Test the message display for albert
Command 7.6 : ___________________________________________   # Test the message display for bernard
Command 7.7 : ___________________________________________   # Test the message display for claude
Command 7.8 : ___________________________________________   # Test the message display for danielle

Expected Result

• When a user logs in with su - name, a message automatically displays (ASCII, quote, message, or visual effect)
• Messages are different for each user
• Effects are visible directly in the terminal after login

Required Screenshots

1. Display of the .bashrc message upon login for each user
2. Content of each modified .bashrc file (cat /home/name/.bashrc or nano)

Allowed Example (for Albert only)

echo 'figlet "Welcome Albert!"' >> /home/albert/.bashrc

For the others, you must invent something unique.

---

PART 8 – Final Reflection Questions

Context

You have now:

• Created and configured multiple users
• Managed specific files and permissions
• Modified user environments via .bashrc
• Verified access and executed scripts according to rights

It is time to step back and reflect on the impacts, risks, and best practices related to what you have implemented.

Instructions

Answer the following questions seriously. You must argue your answers. Copy-pasting a command is not enough. Use examples when relevant.

Your answer can be written directly under each question in the report to be submitted.

Questions to Complete

1. What is the importance of properly configuring permissions on a multi-user Linux system?
(Explain what could happen if all files had 777 permissions.)

Answer:
...............................................................................................................................
...............................................................................................................................
...............................................................................................................................

2. What is the difference between execution permissions (x) and read permissions (r)? Give a concrete example.

Answer:
...............................................................................................................................
...............................................................................................................................
...............................................................................................................................

3. Which command allows changing permissions? Which command allows changing the owner? Give a concrete example of correct use of each.

Answer:
...............................................................................................................................
...............................................................................................................................
...............................................................................................................................

4. What is the difference between belonging to a group (sudo) and being explicitly listed in the /etc/sudoers file?

Answer:
...............................................................................................................................
...............................................................................................................................
...............................................................................................................................

5. Why is it discouraged to give sudo rights to all users of a system? What would be the risks?

Answer:
...............................................................................................................................
...............................................................................................................................
...............................................................................................................................

6. What would happen if a user could modify a script that is executed by an administrator? Give an example of a vulnerability.

Answer:
...............................................................................................................................
...............................................................................................................................
...............................................................................................................................

7. What is the usefulness of customizing the .bashrc? Can it be used as a tool for social engineering or security?

Answer:
...............................................................................................................................
...............................................................................................................................
...............................................................................................................................

---

PART 9 – Environment Variables

Context

You will conduct a series of tests to understand:

• How local and exported variables work
• Their visibility between users
• How to make a variable persistent for a specific user
• How to share a variable (or not) between multiple users

Rules to Follow

• Work each time with a different user (Albert, Bernard, Claude, Danielle)
• Modify only their own environment
• Do not cheat by copying one user's .bashrc to another — each user must be treated independently

Objectives

• Define variables for each user
• Test their visibility in a subshell
• Verify that another user cannot see the variable
• Add a permanent variable via each user's .bashrc

Scenario 1 – Local and Exported Variables

Steps to Follow for Each User

(Start with Albert)

Command B1.1 : ___________________________________________   # Log in with su - albert
Command B1.2 : ___________________________________________   # Create a local variable name="Albert"
Command B1.3 : ___________________________________________   # Display the variable
Command B1.4 : ___________________________________________   # Launch a subshell with bash
Command B1.5 : ___________________________________________   # Check if the variable is still visible
Command B1.6 : ___________________________________________   # Export the variable name
Command B1.7 : ___________________________________________   # Launch a new shell
Command B1.8 : ___________________________________________   # Verify that the variable is visible in this subshell
Command B1.9 : ___________________________________________   # Exit and switch back to eleve

Repeat these steps for Bernard (name="Bernard"), Claude (name="Claude"), and Danielle (name="Danielle").

Expected Result

• Non-exported variables disappear in a subshell
• Exported variables persist in a subshell
• Each user can only access their own variables

Scenario 2 – Permanent Variables via .bashrc

Steps to Follow (example with Claude)

Command B2.1 : ___________________________________________   # Log in with su - claude
Command B2.2 : ___________________________________________   # Open the ~/.bashrc file
Command B2.3 : ___________________________________________   # Add export PROJET_CLAUDE="System Project"
Command B2.4 : ___________________________________________   # Reload ~/.bashrc with source
Command B2.5 : ___________________________________________   # Verify that the variable is well defined
Command B2.6 : ___________________________________________   # Close the session and reconnect to test persistence
Command B2.7 : ___________________________________________   # Redo echo $PROJET_CLAUDE

Repeat the same process with:

• PROJET_ALBERT="Security Lab" for Albert
• PROJET_BERNARD="Scripts Lab" for Bernard
• PROJET_DANIELLE="Admin Lab" for Danielle

Expected Result

• Each user has a permanent variable visible upon login
• These variables are only visible to their user
• The echo $PROJET_X command returns the correct value after reboot

Reflection Questions to Write in Your Report

1. What difference do you notice between an exported variable in the terminal and a variable added in .bashrc?
...............................................................................................................................

2. Is it possible for Bernard to access a variable defined by Albert? Why?
...............................................................................................................................

3. What method would you use if you wanted to share the same variable among all users? (Hint: /etc/profile)
...............................................................................................................................

4. Can an exported variable be deleted? How?
...............................................................................................................................

5. What should you be careful of when modifying .bashrc? Give an example of a potential error.
...............................................................................................................................

---

PART 10 – Variable Scope Between Users

Context

You will test if a variable defined (local or exported) by Albert is accessible by other users (Bernard, Claude, Danielle).
This will help you understand the limits of variable scope in a multi-user Linux system.

Objectives

• Define an exported variable with one user
• Log in with another user
• Test the variable's scope
• Understand why it is not visible
• Find the correct method to make it visible to all

Steps to Follow

Command B1.1 : ___________________________________________   # Log in with su - albert
Command B1.2 : ___________________________________________   # Create a variable city=Montreal
Command B1.3 : ___________________________________________   # Export the variable city
Command B1.4 : ___________________________________________   # Verify it is well exported (echo $city)
Command B1.5 : ___________________________________________   # Exit the albert session (exit)
Command B1.6 : ___________________________________________   # Log in with su - bernard
Command B1.7 : ___________________________________________   # Attempt to display the variable $city

Expected Result

• The city variable exists only for Albert, even if it was exported
• For Bernard (or any other user), the variable is not visible

Question to Write in Your Report

1. Why is the variable exported by Albert not visible to Bernard?
...............................................................................................................................

2. How can a variable be made accessible to all users automatically?
(Hint: where should export city=Montreal be written for it to be loaded for all users?)
...............................................................................................................................

Optional Extension (advanced bonus – 2 extra points)

Find a way to define a common variable for all users, without having to redeclare it for each.
Indicate the system file to modify and demonstrate with Albert, Bernard, or Danielle.

Summary Table – Variable Scope in a Linux System

Location / Method	Visible to the current user?	Visible in a subshell?	Visible to other users?	Persists after session closure?
city=Montreal	✅	❌	❌	❌
export city=Montreal	✅	✅	❌	❌
Added in ~/.bashrc	✅	✅	❌	✅ (for this user only)
Added in /etc/profile or /etc/environment	✅ for all	✅ for all	✅	✅

Conclusion to Insert in the Report

• A variable defined in the terminal is local to the current shell. True or false?
• An exported variable is inheritable by subshells, but never by other users. True or false?
• To make a variable permanent, it must be placed in a file like .bashrc. True or false?
• To make it accessible to all users, it must be written in a shared system file like /etc/profile, with caution (root rights required). True or false?

---

Bonus PART – Additional Reflection Questions

1. What is the difference between chmod a+x and chmod 755?
...............................................................................................................................

2. Why restrict execution rights to certain users?
...............................................................................................................................

3. What happens if a file has 777 rights in a sensitive environment?
...............................................................................................................................

4. What is the purpose of the sticky bit in a directory like /tmp?
...............................................................................................................................

5. How to prevent a user from accidentally becoming the owner of a critical file?
...............................................................................................................................

---

Lab created on: December 2024