Users, groups and permissions: chmod, chown, sudo
Accounts, groups, file permissions, ownership and sudo.
Level 101 · 18 lessons · 15 practice labs
Lessons
Who is there
- Accounts and the /etc/passwd fields: You will read how each Linux account is defined in the /etc/passwd file and understand what every field on a line means.
- Groups and membership: You will see which groups a user belongs to and understand why group membership decides who can access what.
- Creating, changing and removing accounts: useradd, usermod, userdel: With useradd, usermod and userdel you can open and adjust an account for an employee, then remove it safely when they leave.
- Managing groups: groupadd, gpasswd and supplementary groups: With groupadd and gpasswd you can build team groups, add and remove members, and explain when a change takes effect.
- Short task: create accounts and a group for a team of three
Permissions
- Ownership and the ls -l columns: You will read the columns of ls -l output and see a file's owner, group and permissions at a glance.
- Permission bits: rwx on files and directories: You will explain what read, write and execute permissions mean on a file and, differently, on a directory.
- chmod: symbolic and octal modes: You will change permissions with chmod in both letter and number form, and read what access a given permission value grants.
- Changing owner and group: You will learn to change a file's owner and group, and how that changes who is able to reach it.
- Default permissions: umask: You will understand how umask sets the permissions of newly created files and how to pick a safe default.
- ACLs: fine-grained access with setfacl and getfacl: You will grant a specific user access where standard permissions fall short and pass it to new files with default ACLs.
- Short task: make the reports folder readable by accounting only
Authority
- sudo, root and an intro to sudoers: You will learn why the administrator (root) account is not used all the time, and how sudo grants power in a temporary, controlled way.
- Special permissions: setuid, setgid, sticky bit: You will understand what the setuid, setgid and sticky bit permissions do and why they deserve careful review.
- Setting up a shared team directory: You will set up a shared directory for a team on your own lab machine, giving only the access people really need.
- Password policy: chage, passwd and pwquality: With chage, passwd and pwquality you can set password lifetime and complexity rules and lock accounts nobody uses.
- Short task: give the help desk the right to reset passwords and nothing more
Wrap-up
- Capstone: audit overly open permissions: On a fictional company's server you find files and directories with overly open permissions, list them and tighten them.
Practice labs
- Find the shell of an account that cannot log in: List the accounts in /etc/passwd whose shell is nologin and separate the human accounts that can log in.
- Set up accounts and a group for a team of three: Create accounts for three new staff, create a shared team group and add them all to it as a supplementary group.
- Find accounts sharing a UID: Find the two accounts sharing a UID, change the unauthorised one's UID and fix its file ownership.
- Fix files created too open by a bad umask: Find the umask setting that makes new files world-readable, fix it and tidy the affected files' permissions.
- Apply a password ageing policy: Apply a maximum password age and warning period to accounting accounts with chage and report the expired account.
- Repair a user who lost their extra groups: Restore the group memberships of a user who lost them when usermod -G was run without -a.
- Apply requested permissions in octal: Apply the correct octal mode to each file with chmod according to the given table.
- Fix a directory you can list but not enter: Fix the permissions on a directory the team can list but not enter, using what the x bit means on directories.
- Open the reports folder to accounting only: Set the reports folder's ownership and permissions so only accounting can read it, with read-only ACL access for one auditor.
- Grant one user read access with an ACL: Add read access for one user to a project file with setfacl without changing the group permissions.
- Stop people deleting each other's files: Apply setgid and the sticky bit to the shared directory so new files inherit the group and nobody can delete others' files.
- Find the unauthorised SUID file: Compare the SUID files on the system with the known list, find the extra one and remove its SUID bit.
- Let the help desk reset passwords: Allow the help desk group to run only passwd through sudo, for any account except root.
- Narrow an overly broad sudo rule: Restrict a developer's ALL sudo rule to the two commands they actually need.
- Audit overly open permissions: Find world-writable files, excessive sudo rights and passwordless accounts, collect them in one report and fix them.
About this course
Accounts, groups, file permissions, ownership and sudo.
What you will learn
- Who is there
- Permissions
- Authority
- Wrap-up
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.