Day 5 - Week 4 Comprehensive Review: Tying the Account and Permission System into One Picture

📌 Key Takeaways

• All Linux access control reduces to "which field/bit of which file is what."
• Account file field counts 7-9-4-4, permissions 644-400-644-400. UID 0 = root (decided by number, not name).
• usermod -G alone wipes the existing secondary groups — always use -aG.
• umask 022 → file 644, directory 755. This is because the starting points differ: 666/777.
• Three security checks: UID 0 accounts · abnormal SetUID binaries · missing /tmp Sticky.

The Four Account Files — Review of Fields and Permissions

This week covered the skeleton of Linux security. We connect the four pieces (account files → management commands → permission arithmetic → special permissions and ACLs) into a single picture.

Points to lock into memory:

• passwd has 7 fields, shadow 9 fields, group/gshadow 4 fields each
• UID 0 = root (decided by number, not name)
• shadow date fields = days since 1970-01-01
• The primary group is in passwd (GID), secondary groups are in group (member list)

passwd↔shadow and group↔gshadow are pairs split into "public (644, identity/membership) and secret (400, hashes/policy)." Consistency is checked with pwck (passwd/shadow) and grpck (group/gshadow).

Account Management Commands — Mapping Options to Fields

⚠️ Trap Review: usermod -G (alone) wipes the existing secondary groups and replaces them. Always -aG. You can assume this shows up on the exam every week.

su vs sudo — Two Models of Privilege Escalation

The hyphen in su - = login shell (fully applies the target's environment). sudoers specifies groups with % (Red Hat=wheel, Ubuntu=sudo). Always edit with visudo (syntax check + lock).

Permission Arithmetic — rwx·Octal·umask

⚠️ Trap Review: umask 022 → file 644, directory 755. Files start from 666 and directories from 777 (files exclude x by default). The larger the umask, the more restrictive.

On a directory, x = entry (cd), and deleting a file depends not on the file but on the directory's w permission. chown (changing the owner) is possible only for root.

Special Permissions and ACLs — Beyond the 9 Bits

The kernel ignores SetUID on shell scripts (for security). SetUID search = find / -perm -4000. If an ACL exists, there is a + at the end of the ls -l permissions. The mask is the upper bound of named user/group permissions.

Frequently Intertwined Scenarios — Integrated Thinking

Scenario A — Building a new collaboration directory

groupadd devteam
usermod -aG devteam alice
usermod -aG devteam bob
mkdir /shared && chgrp devteam /shared
chmod 2775 /shared          # SetGID: all new files inherit the devteam group

• SetGID (2) + group write (the w in 7) lets team members edit each other's files. It integrates Day 2 (groups) + Day 3 (permissions) + Day 4 (SetGID).

Scenario B — New employee account + forced change at first login

useradd -m -s /bin/bash -c "New Hire" newbie
passwd newbie               # set the initial password
chage -d 0 newbie           # force a password change at next login
chage -M 90 -W 7 newbie     # change every 90 days, warn 7 days before

• It integrates Day 1 (shadow fields) + Day 2 (useradd/passwd/chage).

Scenario C — Security check

awk -F: '$3==0{print $1}' /etc/passwd   # UID 0 accounts (only root is normal)
find / -perm -4000 -type f 2>/dev/null  # suspicious SetUID
ls -ld /tmp                              # check Sticky

The first step of real-world breach incident analysis is exactly these three — a UID 0 backdoor account, abnormal SetUID binaries, and a missing Sticky on /tmp. Since a one-line command can instantly check the key holes in system security, this week's content is the basis of real-world security beyond the exam.

📖 Glossary

• UID 0 : The definition of root privilege. The kernel looks only at this number, not the account name.
• passwd↔shadow / group↔gshadow : Two pairs split into a public file (identity/membership) and a secret file (hashes/policy).
• pwck / grpck : Commands that check the consistency of the two pairs.
• -g vs -G : The option that sets one primary group, and the option that sets several secondary groups.
• usermod -aG : Adds while keeping existing secondary groups. Forgetting -a replaces them wholesale.
• chage -d 0 : A technique that sets the last change date to 0 to force a password change at the next login.
• The hyphen in su - : An indicator to fully apply the target user's login environment (PATH·HOME·profile).
• visudo : The dedicated command that edits sudoers with syntax checking and locking.
• wheel / sudo group : The default administrator groups of Red Hat-family and Ubuntu-family systems.
• umask : A mask that sets the permissions to shave off for newly created files and directories. The larger, the more restrictive.
• w on a directory : The permission to delete files in it. Unrelated to the file's own permissions.
• SetUID / SetGID / Sticky : Runs with the owner's privileges / group execution and group inheritance / deletion protection for shared directories.
• ACL mask : The upper bound of the permissions that named ACL entries can have.