Permissions

File permissions

The Unix permission model — read/write/execute, owner/group/other, special bits.

namei — permissions at every step of a path

The namei command walks a path part by part and shows the type, mode and owner of each directory down to the file.

sudo — running commands as another user

Grants temporary root rights via sudoers; edit the file only through visudo, or a mistake locks everyone out of sudo.

visudo — edit sudoers safely

The visudo command edits /etc/sudoers and files in /etc/sudoers.d and refuses to save a rule with a grammar error.

PAM: login checks, password policy and lockout

The module stack in /etc/pam.d decides whether to let a user in, which password to accept and when to lock them out.

Users and groups

Linux accounts and groups; usermod -G without -a replaces all of a user's supplementary groups instead of adding one.

useradd — create a user

The useradd command creates a user account with a home directory, shell, groups and UID; passwd sets the password.

passwd — change or lock a password

The passwd command changes your own password; as root it sets, locks and shows the passwords of other users.

usermod — change an account and its groups

The usermod command changes an existing account — groups, login shell, home directory, name and locking.

Unix sockets — processes talking through a file

A unix socket is a file through which processes on one machine exchange data; connecting needs write permission on it.

chmod / chown — permissions and ownership

Changing permissions (chmod) and owner/group (chown) — numeric and symbolic syntax, umask, chgrp.

umask — the mask for new files and directories

umask is a process mask: which permissions to remove from a new file (from 666) and directory (from 777).

Special permission bits: setuid, setgid, sticky

Special permission bits: setuid and setgid run a program as its owner; setgid and sticky shape shared directories.

Capabilities: root split into parts

Parts of root's rights: a process or a file gets only the one it needs, e.g. CAP_NET_BIND_SERVICE for a low port.

SSH keys and ssh-agent

Key pairs for passwordless login; sshd rejects ~/.ssh if it is writable by the group or by others.

Extended permissions (ACL)

Flexible rights beyond rwx — getfacl/setfacl, per-user and per-group grants.

Service hardening: User=, ProtectSystem, NoNewPrivileges

Unit settings that strip a service of root, system writes and new privileges; systemd-analyze security rates them.

AppArmor

Mandatory access control on Ubuntu — service profiles, enforce/complain modes.

Disk quotas

Limiting space and file counts per user/group — enabling, configuring, reports.

chage — password and account expiry

Reads and changes local password aging settings and an account expiration date.

nologin — a shell that refuses login

A login-shell replacement that reports refusal and exits instead of opening an interactive shell.