Linux: Authenticate and Authorize Users

So far, in the Google Cybersecurity Certificate, I have covered what I learnt regarding the Linux OS. Today, continuing with the commands, I talk about permissions and overall user authorization in Linux.

The topics covered are:

File permissions and ownership

Change permissions

Manage Authorization

Add and delete users

1-File permissions and ownership:

A good rule to remember in cybersecurity is the principle of least privilege:

“Data access is on a need-to-know basis.”

This means that not every user should have access to all files and directories in a system, as this could pose many security risks.

Types of permissions:

The three types of permissions are:

• Read permissions:

On files: Reading the contents of the file.

On directories: It allows the user to list the contents (filenames) of the directory.

• Write permissions:

On files: Allow modifications of the contents of a file, editing and updating data.

In the directory: New files can be created in that directory.

• Execute permissions:

On file: The file can be run as a program or script if the execute bit is set, regardless of file extension.

On directory: Allows the user to enter a directory and execute files.

Types of owners and the Linux permissions for them:

There are three types of owners: User , Group of users, and Others.

The permissions of these types in Linux are represented by:

drwxrwxrwx

Breakdown:

This string can be divided into 4 sections:

d: D means a directory, so the permissions are to work on a directory. If this were a file instead of a directory, d would be replaced by the hyphen —

1st rwx : This is for the User, he has r (read), w (write), and x (execute) permissions.

2nd rwx : This one is for the Group, the group also has read (r), write (w) and execute (x) permissions.

3rd rwx : This means that Others can also have permissions to Read (r), Write (w) and Execute (x).

Checking the existing permissions:

The ls command is used to list files and directories in the working directory. You can use specific options to check their permission status:

**ls -a**: Displays all files, including hidden ones (which start with a .).

Note: You will notice . and .. entries appearing. These are special directory entries, . represents the current directory, and .. represents the parent directory. They are essential to how Linux navigates the file system tree.

**ls -l**: Displays a long-format list showing owner, group, file type, and last modification time.

**ls -la**: A combination of the previous options that shows both hidden and regular files with full details.

2-Change permissions:

We can change the permissions in order to secure the files from unauthorized access using the command:

chmod : change mod

For example:

chmod g+w,o-r access.txt

This command is divided into 4 parts:

1- chmod : This is the command for changing the permissions.

2- g+w : Let's break this down further:

• g : This is for the Group of users
• + : Plus indicates that permissions are to be given
• w : It means to Write

Overall: Give Write permissions to the Group of owners

3- o-r : Let’s break this down as well:

• o : This means the Others
• - : Minus indicates that permissions are to be taken away
• r : It means to Read

Overall: Take away the Read permissions from the Others

4- access.txt : This is the name of the file to which the permissions are applied. This is the last argument of the command.

3- Manage Authorization:

The following tasks show how the commands are put to use:

Task 1. Check file and directory details:

Task 2. Change file permissions:

Task 3. Change file permissions on a hidden file:

Task 4: Change directory permissions:

4- Add and delete users:

Authentication and why it matters:

Authentication: Authentication is the act of proving to be someone you claim to be. That you are “authentic”.

Similarly, in security, authenticating users means proving that the user is actually who they are claiming to be. Authentication matters because if a person is no longer a part of the group, but he still has access to the group’s information and has the privileges to run commands, then it poses a security risk. So, adding and deleting users is important once they join a group or leave the group.

The root user and the sudo command:

To manage such kind of authorization and authentication of users, a person has to be a “root user”, who has all sorts of administrative rights over all the files and directories. But being the root user has its own security risks. A user account might get compromised while still being the root user, causing the whole system to be compromised because of the root privileges.

The alternative of running the system as the root user is the sudo command.

The sudo command:

The sudo command gives a user those administrative rights without being the root user. The permissions can be to modify, add, and delete users from the system. The full form is “super user do”.

The risk of giving the users rights to a sudo command are present as well. It is just like a hotel. The manager of the hotel might have the master key, which can unlock every room in the hotel. But the same key might be used by the staff, janitors, cleaners etc. If anyone were to get access to that janitor’s key, it’s over. So, it is important to consider which users are getting permissions for this command.

The following commands can be run using sudo :

Sudo command will ask for the password for the user that the command is running.

• useradd :

It’s for adding the user to a system. The syntax is sudo useradd username

• userdel :

It’s for removing users from a system they are no longer concerned with. The command is written as sudo userdel username

• usermod :

It modifies the existing user accounts. The command can be run with additional options like: sudo usermod -g executive username, it is going to change the users existing group to the executive one.

• chown :

It changes ownership of a file or directory. It can be used like this:

sudo chown username acess.txt

Commands in play:

Following is the demonstration of several commands using sudo :

Task 1. Add a new user:

To complete this task, the following things are done here:

Added researcher9 to the system.

Added researcher9 to the research_team group as their primary group.

Task 2. Assign file ownership:

Task 3. Add the user to a secondary group:

Task 4. Delete a user:

When you create a new user in Linux, a group with the same name as the user is automatically created and the user is the only member of that group. After removing users, it is good practice to clean up any such empty groups that may remain behind.

That was all about the Linux commands and managing files and permissions. Although there are many commands, the few are discussed here.