Level 3 · 3A Systems and the terminal · Lesson 3 of 3
Permissions: who can do what
In Linux, every file says who can read it (r), change it (w) and run it (x). And it says this for three groups: the owner, the group and everyone else. With ls -l you see it as -rw-r----- at the start of each line.
The chmod numbers
chmod changes permissions. Each digit is a sum: read is worth 4, write is worth 2 and execute is worth 1. You write three digits, in the order owner, group and others. 600 means only the owner reads and writes. 640 adds that the group can also read. 777 means anyone can do anything: that is almost never a good idea.
ls -l
chmod 600 claves.txt
chmod 640 copia-seguridad.sql- ls -l shows the permissions of each file.
- chmod 600 makes the file readable only by its owner.
- chmod 640 also lets the group read it.
The principle of least privilege
Every person and every program should have only the permissions it needs for its job, and nothing more. If an account falls into an attacker's hands, the damage is limited to what that account could do. Files with passwords, database backups and private SSH keys should be readable only by their owners.
ls -a /tmp
rm /tmp/.actualizar.sh- ls -a also shows hidden files, the ones that start with a dot.
- rm file deletes a file (rm -r deletes a folder). There is no trash bin: what you delete does not come back, so think twice.
Going deeper
Owner, group and others
When someone tries to open a file, the system checks in order: are they the owner? It uses the owner's permissions. Are they in the group? It uses the group's. If not, it uses the "others" permissions. That is why any user on the server can read a 644 file: it is no good for keeping secrets.
Review questions
What permissions does chmod 600 give a file?
Answer: Only the owner can read and write it. 6 = read (4) + write (2) for the owner; the zeros take everything away from the group and others.
A file with the database passwords has 777 permissions. What do you do?
Answer: Close it with chmod 600. With 777 anyone can read and change the passwords. Least privilege says you should close it.
In the log you see that a strange IP successfully logged in to the "deploy" account after many failed attempts. What do you do first?
Answer: Treat the account as compromised: change its password, block the IP and check what it left behind. Many failures followed by one success is the sign of a guessed password. You need to contain it, clean up and report it.