Red Hat System Administration I

Bookmark this page
P12345678910111213141516
PreviousNext

Lab: Controlling Access to Files with Linux File System Permissions

Performance Checklist

In this lab, you will configure a system with directories for user collaboration.

Outcomes

  • A directory on serverX called /home/stooges where these three users can work collaboratively on files.

  • Only the user and group access, create, and delete files in /home/stooges. Files created in this directory should automatically be assigned a group ownership of stooges.

  • New files created by users will not be accessible outside of the group.

Reset your serverX system. Log into and set up your server system. 

[student@serverX ~]$ lab permissions setup

Your serverX machine has three accounts, curly, larry, and moe, who are members of a group called stooges. The password for each account is password.

  1. Open a terminal window and become root on serverX.

    [student@serverX ~]$ su -
Password: redhat
[root@serverX ~]#

  2. Create the /home/stooges directory.

    [root@serverX ~]# mkdir /home/stooges

  3. Change group permissions on the /home/stooges directory so it belongs to the stooges group.

    [root@serverX ~]# chown :stooges /home/stooges

  4. Set permissions on the /home/stooges directory so it is a set GID bit directory (2), the owner (7) and group (7) have full read/write/execute permissions, and other users have no permission (0) to the directory.

    [root@serverX ~]# chmod 2770 /home/stooges

  5. Check that the permissions were set properly.

    [root@serverX ~]# ls -ld /home/stooges 
drwxrws---. 2 root stooges 1024 Dec 9 1:38 /home/stooges

  6. Modify the global login scripts so that normal users have a umask setting which prevents others from viewing or modifying new files and directories. 

    [root@serverX ~]# vim /etc/bashrc
[root@serverX ~]# vim /etc/profile
[root@serverX ~]# less /etc/bashrc
# You could check uidgid reservation validity in
# /usr/share/doc/setup-*/uidgid file
if [ $UID -gt 199 ] && [ "`id -gn`" = "`id -un`" ]; then
     umask 007
else
     umask 022
fi
 
for i in /etc/profile.d/*.sh ; do

  7. When you finish, open a terminal window on serverX and run lab permissions grade to confirm you have done everything correctly.

    [student@serverX ~]$ lab permissions grade
PreviousNext
Revision: rh124-7-1b00421