Module 5: Users, Groups and Permissions - Accounts, chmod, sudo & ACLs

5.1 User Management

Linux is a multi-user operating system designed to isolate processes, files, and resources between distinct accounts. The superuser (root, UID 0) holds unrestricted administrative authority, while standard users operate within constrained permission boundaries.

5.1.1 Creating and Managing User Accounts

Linux distributions provide both low-level backend utilities and high-level interactive wrappers:

Command	Type	Primary Function	Example Syntax
useradd	Low-level binary	Creates a new user with raw flags (does not create home directory unless specified)	useradd -m -s /bin/bash devops
adduser	High-level Perl script	Interactive Debian/Ubuntu tool that configures home, skeleton files, and password automatically	sudo adduser alice
usermod	Maintenance binary	Modifies user properties, shell, home directory, or group memberships	usermod -aG sudo,docker alice
userdel	Removal binary	Removes user account. Use `-r` flag to delete their home directory and mail spool	userdel -r devops

5.1.2 Account Databases: /etc/passwd and /etc/shadow

`System Account Files`

/etc/passwd (World-Readable):Contains account definitions formatted as 7 colon-separated fields: username:password_placeholder(x):UID:GID:GECOS(full name):home_directory:default_shell.
The 'x' Placeholder:Historical Unix versions stored password hashes directly in /etc/passwd. Because standard utilities need to read user IDs, passwords were moved to /etc/shadow, leaving an 'x' in this field.
/etc/shadow (Root-Only Readable):Stores salted cryptographic password hashes (SHA-512 or yescrypt) alongside account expiration, password change date, minimum/maximum password age, and warning periods.

5.1.3 Password Policy and Aging: passwd and chage

`Password and Aging Utilities`

passwd [username]:Sets or changes passwords. Root can update any password without entering the old one: sudo passwd alice.
passwd -l / -u:Locks (-l) or unlocks (-u) an account by prepending an exclamation point to the password hash in /etc/shadow.
chage -l username:Lists account password aging details (last change date, expiration date, days until expiration warning).
chage -M 90 -W 7 username:Enforces password expiration every 90 days with a 7-day warning period before forced change.

5.1.4 Switching Users: su, whoami, id

`Identity Verification Commands`

whoami:Prints the effective username of the active shell session.
id:Prints effective UID, primary GID, and all supplementary group memberships (e.g., uid=1000(student) gid=1000(student) groups=1000(student),4(adm),27(sudo)).
su - username (Login Shell):The minus symbol (-) simulates a full fresh login, resetting environment variables ($HOME, $PATH) to the target user defaults.
su username (Non-Login Shell):Switches user privileges while retaining the original user's current environment variables and working directory.

5.2 Group Management

Groups allow system administrators to apply shared permissions across collections of users without granting root privileges or modifying individual file permissions repeatedly.

5.2.1 Group Commands: groupadd, groupmod, groupdel

`Group Lifecycle Management`

sudo groupadd developers:Creates a new group definition and assigns the next available GID (typically 1000+).
sudo groupmod -n dev-team developers:Renames an existing group without changing its numeric GID.
sudo groupdel dev-team:Removes a group definition. Fails safely if the group is still the primary group of any user.

5.2.2 Primary vs Secondary (Supplementary) Groups

Every user account belongs to exactly one primary group and zero or more secondary groups:

`Group Classification`

Primary Group:Assigned automatically upon creation. When a user creates a new file, the file's group ownership is set to the user's primary group. Stored in field 4 of /etc/passwd.
Secondary (Supplementary) Groups:Additional memberships granting access to resources like Docker daemon sockets (docker), audio devices, or shared project repositories.
The Critical -a Flag:Always use usermod -aG group user. Leaving off the append flag (-a) strips the user from all other supplementary groups!

5.2.3 /etc/group and gpasswd

`Group Database and Administration`

/etc/group File Format:4 colon-separated fields: group_name:password_placeholder(x):GID:comma_separated_member_list (e.g., docker:x:998:alice,bob).
sudo gpasswd -a alice developers:Adds user alice to the developers group.
sudo gpasswd -d alice developers:Removes user alice from the developers group.
Session Requirement (newgrp):Group changes take effect on the user's next login, or immediately within the current shell by typing newgrp developers.

5.3 File Permissions

Linux enforces access rights through standard permission bits evaluated in order: Owner (User), Group members, and Others (everyone else on the system).

5.3.1 Reading ls -l Output

A sample long listing (ls -l) presents a 10-character permission string:

Position	Characters	Target Entity	Description
1	- or d	File Type	Hyphen for regular file; 'd' for directory; 'l' for symlink
2 - 4	rwx	User (Owner)	Permissions applying to the specific user account that owns the file
5 - 7	r-x	Group	Permissions applying to users who belong to the file's owning group
8 - 10	r--	Others	Permissions applying to all other accounts on the system

5.3.2 Read, Write, and Execute on Files vs Directories

`Permission Meaning Differences`

Read (r, value 4):On files: allows viewing contents. On directories: allows listing file names with ls.
Write (w, value 2):On files: allows modifying file content. On directories: allows creating, deleting, and renaming files inside the directory regardless of who owns them.
Execute (x, value 1):On files: allows running the file as a program or script. On directories: allows entering the directory (cd) and accessing files inside.

5.3.3 Modifying Permissions: chmod Octal and Symbolic Modes

Permissions can be expressed either numerically (octal) or symbolically:

Octal Mode	Permission String	Target Use Case	Symbolic Equivalent
755	rwxr-xr-x	Executable scripts, public directories, web document roots	u=rwx,go=rx
644	rw-r--r--	Standard configuration files, web images, regular documents	u=rw,go=r
600	rw-------	Private SSH keys (`id_rsa`), SSL certificates	u=rw,go=
700	rwx------	User `.ssh` directory, root home folder	u=rwx,go=

`Symbolic chmod Quick Modifiers`

chmod +x script.sh:Adds execute permissions for all entities (user, group, others).
chmod u=rwx,g=rx,o= file.txt:Explicitly sets owner to full, group to read/execute, and revokes all permissions from others.
chmod g-w file.txt:Revokes write permission from the group without changing user or other bits.

5.3.4 umask and Default Creation Permissions

When a program creates a new file or directory, the system subtracts the active umask (user mask) from maximum base permissions:

`umask Arithmetic`

Maximum Base Permissions:Files default to 666 (rw-rw-rw-); directories default to 777 (rwxrwxrwx).
Default System umask 022:Subtracting 022 from 666 yields 644 (rw-r--r--) for files. Subtracting 022 from 777 yields 755 (rwxr-xr-x) for directories.
Strict umask 027 (Server Hardening):Subtracting 027 yields 640 for files and 750 for directories, preventing 'others' from reading newly generated data.

5.4 File Ownership

5.4.1 Changing Owners and Groups: chown and chgrp

`Ownership Management`

sudo chown alice file.txt:Changes user ownership to alice while keeping group ownership unchanged.
sudo chown alice:developers file.txt:Changes both user owner and group owner simultaneously.
sudo chown :developers file.txt:Changes group ownership without modifying the user owner (identical to chgrp developers file.txt).

5.4.2 Recursive Changes and Safety Checks

The recursive flag (-R) applies changes to a directory and all nested child items:

`Recursive Ownership Safety`

sudo chown -R www-data:www-data /var/www/html:Assigns web server ownership to all application source files recursively.
Catastrophic Safety Warning:Never execute chown -R user / or chmod -R 777 /. Altering root filesystem ownership breaks setuid binaries like sudo and halts system operation.

5.4.3 Shared Project Directories

When multiple developers share a directory (e.g., /opt/project), combine group ownership with the SGID bit:

`Shared Collaboration Directory Recipe`

1. Create Group and Directory:sudo groupadd devteam && sudo mkdir /opt/project
2. Assign Group Ownership:sudo chown :devteam /opt/project
3. Grant Group Write Permissions:sudo chmod 775 /opt/project
4. Enable SGID Inheritance:sudo chmod g+s /opt/project (ensures new files inherit group 'devteam' automatically).

5.5 Privilege Escalation with sudo

The sudo (Superuser Do) utility allows permitted users to execute administrative commands with temporary root privileges while logging actions for accountability.

5.5.1 sudo vs Logging In as Root

`Why sudo is the Modern Standard`

Audit Logging:Every sudo invocation writes timestamped records to /var/log/auth.log, establishing clear accountability.
Personal Password Verification:Users authenticate using their own personal password, eliminating the hazard of sharing a single root password among engineers.
Least Privilege:Users can be restricted to specific commands (e.g., only restarting web services) rather than receiving full root shells.

5.5.2 /etc/sudoers and visudo

The /etc/sudoers file defines sudo privilege rules. Never edit this file with standard text editors! Always use sudo visudo:

`visudo Protection`

Syntax Validation:Before saving changes to disk, visudo parses syntax. If a typo exists, it refuses to save and keeps the editor open, preventing server lockouts.
File Locking:Prevents simultaneous concurrent edits from overwriting each other.
Drop-in Directory (/etc/sudoers.d/):Place modular team configurations inside /etc/sudoers.d/developers instead of editing the main file directly.

5.5.3 Granting Limited Sudo Rights

`Sudoers Syntax Examples`

%sudo ALL=(ALL:ALL) ALL:Members of group 'sudo' can run any command as any user on any host.
alice ALL=(root) /usr/bin/systemctl restart nginx:Restricts alice to restarting Nginx exclusively without granting general root access.
bob ALL=(ALL) NOPASSWD: /usr/bin/apt update:Permits bob to update package lists without prompting for a password (useful in automated CI/CD).

5.6 Special Permissions and ACLs

5.6.1 SUID, SGID, and the Sticky Bit

Three special bits extend standard read, write, and execute permissions:

Special Bit	Octal	Symbolic	Behavior on Files	Behavior on Directories
SUID	4000	u+s (rws------)	Executes process with privileges of the file owner (e.g., `/usr/bin/passwd`)	No standard effect on directories
SGID	2000	g+s (rwxr-s---)	Executes process with privileges of the file group	New files created inside inherit directory's group ownership automatically
Sticky Bit	1000	o+t (rwxrwxrwt)	Historical legacy memory caching (unused in modern kernels)	Only the file owner or root can delete or rename files (e.g., `/tmp`)

5.6.2 Granular Permissions with POSIX ACLs

Standard Linux permissions only support one user owner and one group. When you need to grant a specific user access without changing file ownership, use Access Control Lists (ACLs):

`Managing ACLs`

getfacl file.txt:Displays detailed ACL permissions including specific individual user and group entries.
setfacl -m u:alice:rwx file.txt:Grants user alice read, write, and execute permissions on file.txt directly.
setfacl -m d:g:developers:rx /shared:Configures default (d:) ACLs on a directory so all future files automatically grant permissions.
setfacl -b file.txt:Removes all extended ACL entries, restoring standard traditional Linux permissions.

5.6.3 Auditing Risky Permissions

`Security Audit One-Liners`

Find SUID Binaries: find / -perm /4000 -type f 2>/dev/null:Scans for executables running with root rights. Attackers target SUID binaries to achieve local privilege escalation.
Find World-Writable Files: find / -perm -002 -type f 2>/dev/null:Locates files that any unprivileged local user can overwrite.
Find Unowned Files: find / -nouser -o -nogroup 2>/dev/null:Identifies orphaned files whose owner account was deleted from /etc/passwd.

Knowledge Check: Module 5 Users, Groups and Permissions

1. Which file stores encrypted user password hashes?

2. What octal mode represents rwxr-xr-x permissions?

3. Which command safely edits the sudoers configuration file?

4. What does the sticky bit on a shared directory prevent?

5. Which command adds user dev to supplementary group docker?

6. What is the default umask on most Linux systems?

Previous Next