Users, Groups, Permissions and Packages

On a Linux server, security rests first on a simple idea: every process runs on behalf of a user, and every file belongs to a user and a group. The F2 course introduced chmod and the rwx notation. Here, we take the administrator’s point of view: who should be able to do what on the machine that hosts your application?

Who am I?

whoami          # name of the current user
id              # uid, gid and list of groups
# uid=1000(lea) gid=1000(lea) groups=1000(lea),27(sudo),33(www-data)
getent passwd lea    # lea's line in the account database (/etc/passwd)
getent group www-data

Accounts are described in /etc/passwd, groups in /etc/group and encrypted passwords in /etc/shadow, readable by root only.

root, sudo and service accounts

root (uid 0) has all rights: it can read, modify or delete anything. You therefore never work logged in as root. You use a normal account that is a member of the sudo group (Debian, Ubuntu) or wheel (Fedora, RHEL), and occasionally prefix a command:

sudo apt update          # a single command with root rights
sudo -l                  # what am I allowed to do with sudo?
sudo -u postgres psql    # run as another user

sudo rules are edited with sudo visudo or in a file under /etc/sudoers.d/: visudo checks the syntax before saving, which avoids locking yourself out of sudo.

An essential good practice: each application runs under a dedicated service account, with no password or login shell. If the application is compromised, the attacker only gets the rights of that account.

sudo useradd --system --no-create-home --shell /usr/sbin/nologin notes

Creating users and groups

sudo groupadd equipe                          # new group
sudo useradd -m -s /bin/bash -G equipe alice  # -m creates /home/alice, -G secondary groups
sudo passwd alice                             # set a password
sudo usermod -aG www-data deploy              # ADDS a group (-a is essential)

Without -a, usermod -G replaces the list of secondary groups: the user may lose membership of the sudo group. A new group is only taken into account at the next login (or in a shell opened with newgrp www-data).

Owner and group: chown

sudo chown deploy:www-data /srv/site/index.html   # owner and group
sudo chown -R deploy:www-data /srv/site           # -R: recursive
sudo chgrp equipe rapport.pdf                     # group only
stat -c '%a %U:%G' /srv/site/index.html
# 640 deploy:www-data

stat -c displays exactly what you want to check: %a the permissions in octal, %U the owner, %G the group. Typical example: a site’s files belong to deploy (who publishes) with the group www-data (the web server reads them), as 640 for files and 750 for directories.

umask: default permissions

A created file would start from 666 (a directory from 777); the umask removes permissions from these values.

umask	Created file	Created directory
022 (common)	644 rw-r--r--	755 rwxr-xr-x
027	640 rw-r-----	750 rwxr-x---
077	600 rw-------	700 rwx------

umask          # displays the current value, for example 0022
umask 027      # valid for the current shell and its children

Shared folder: the setgid bit

A team wants a folder where everyone drops files that all members can modify. The setgid bit on a directory (the 2 in front of the permissions) means every file created inside receives the directory’s group, not its creator’s primary group.

sudo mkdir -p /srv/partage
sudo chown root:equipe /srv/partage
sudo chmod 2770 /srv/partage     # setgid + rwx for owner and group, nothing for others
ls -ld /srv/partage
# drwxrws--- 2 root equipe 4096 ... /srv/partage   (the s replaces the group's x)

Installing software: apt

On Debian and Ubuntu, software comes from signed repositories, managed by apt:

sudo apt update                 # refreshes the list of available packages
sudo apt install nginx curl     # installs (and its dependencies)
apt show nginx                  # description, version, dependencies
apt list --installed | grep nginx
sudo apt upgrade                # updates the installed packages
sudo apt remove nginx           # uninstalls (keeps the configuration)

Always run apt update before an installation: otherwise apt looks for versions that are no longer in the repository. On Fedora or RHEL, the equivalent is dnf.