Red Hat System Administration II

Operators and Consultants are members of an IT support company. They need to start sharing information. servera contains a properly configured share directory located at /shares/content that hosts files.

Currently, only members of the operators group have access to this directory, but members of the consultants group need full access to this directory.

The consultant1 user is a member of the consultants group but has caused problems on many occasions, so this user should not have access to the directory.

Your task is to add appropriate ACL entries to the directory and its contents so that members of the consultants group have full access, but deny the consultant1 user any access. Make sure that future files and directories stored in /shares/content get appropriate ACL entries applied.

Important information:

1. Log in to servera and switch to the root user.

   1. Use the ssh command to log in to servera as the student user. The systems are configured to use SSH keys for authentication, therefore a password is not required.

      [student@workstation ~]$ ssh student@servera
      ...output omitted...
      [student@servera ~]$ 

   2. Use the sudo -i command to switch to the root user. The password for the student user is student.

      [student@servera ~]$ sudo -i
      [sudo] password for student: student
      [root@servera ~]# 

2. Add the named ACL to the /shares/content directory and all of its content.

   1. Use setfacl to recursively update the /shares/content directory, granting the consultants group read, write, and conditional execute permissions.

      [root@servera ~]# setfacl -Rm g:consultants:rwX /shares/content

      The -R option means recursive, the -m option means modify/add, rwX means apply read, write, and conditional execute permissions.

   2. Use setfacl to recursively update the /shares/content directory, denying the consultant1 user from the consultants group any access.

      [root@servera ~]# setfacl -Rm u:consultant1:- /shares/content

      The -R option means recursive, the -m option means modify/add, - means give no access.

3. Add the named ACL as the default ACL to support future file and directory additions.

   1. Use setfacl to add a default access rule for the consultants group. Grant read, write, and execute permissions on the content directory.

      [root@servera ~]# setfacl -m d:g:consultants:rwx /shares/content

      The -m options means modify/add, d:g means default group, rwx means apply read/write/execute permissions (needed for proper subdirectory creation and access)

   2. Use setfacl to add a default access rule for the consultant1 user. Deny all access to the content directory.

      [root@servera ~]# setfacl -m d:u:consultant1:- /shares/content

      The -m option means modify/add, d:u means default user, - means no permissions

4. Verify your ACL changes.

   consultant2 should be able to read any file and create a new directory with a new file in it.

   consultant1 should not be able to read, write, or execute any file; this includes being unable to list the directory contents.

   Use su - user to switch to your test users. Use exit or Ctrl+D to leave the test user shell.

   [root@servera ~]# exit
   [student@servera ~]$ su - consultant2
   Password: redhat
   [consultant2@servera ~]$ cd /shares/content/

   1. Use cat to check that consultant2 can read a file.

      [consultant2@servera content]$ cat serverb-loadavg.txt
      #################################################
      serverb.lab.example.com
      #################################################
      Wed Mar 25 15:25:19 EDT 2019
      #################################################
      ldavg 0.18, 0.06, 0.05
      #################################################

   2. Use the loadavg.sh script to check that consultant2 can execute a file.

      [consultant2@servera content]$ ./loadavg.sh
      ldavg 0.00, 0.00, 0.04

   3. Create a directory called reports.

      Use echo to create a file with some content, name the file test.txt, and place it in the new directory.

      Switch back to student when you are finished.

      [consultant2@servera content]$ mkdir reports
      [consultant2@servera content]$ echo "TEST REPORT" > reports/test.txt
      [consultant2@servera content]$ exit
      logout
      [student@servera ~]$ 

   4. Log in as the consultant1 user. Use cd to try and change into the directory as consultant1, and also try ls to list the directory. Both commands should fail with Permission denied.

      Try one or more of the commands that consultant2 used, but as consultant1, to further verify the lack of access. Use the full path, /shares/content, because you cannot use cd to change into the directory.

      Switch back to student when you are finished testing consultant1.

      [student@servera ~]$ su - consultant1
      Password: redhat
      [consultant1@servera ~]$ cd /shares/content/
      -bash: cd: /shares/content/: Permission denied
      [consultant1@servera ~]$ ls /shares/content/
      ls: cannot open directory '/shares/content/': Permission denied
      [consultant1@servera ~]$ cat /shares/content/serverb-loadavg.txt
      cat: /shares/content/serverb-loadavg.txt: Permission denied
      [consultant1@servera ~]$ exit
      logout
      [student@servera ~]$ 

   5. Log in as the sysadmin1 user. Use getfacl to see all the ACL entries on /shares/content and the ACL entries on /shares/content/reports.

      Switch back to student when you are finished testing consultant1.

      [student@servera ~]$ su - sysadmin1
      Password: redhat
      [sysadmin1@servera ~]$ getfacl /shares/content
      getfacl: Removing leading '/' from absolute path names
      # file: shares/content/
      # owner: root
      # group: operators
      # flags: -s-
      user::rwx
      user:consultant1:---
      group::rwx
      group:consultants:rwx
      mask::rwx
      other::---
      default:user::rwx
      default:user:consultant1:---
      default:group::rwx
      default:group:consultants:rwx
      default:mask::rwx
      default:other::---
      
      [sysadmin1@servera ~]$ getfacl /shares/content/reports
      getfacl: Removing leading '/' from absolute path names
      # file: shares/content/reports
      # owner: consultant2
      # group: operators
      # flags: -s-
      user::rwx
      user:consultant1:---
      group::rwx
      group:consultants:rwx
      mask::rwx
      other::---
      default:user::rwx
      default:user:consultant1:---
      default:group::rwx
      default:group:consultants:rwx
      default:mask::rwx
      default:other::---
      
      [sysadmin1@servera ~]$ exit
      logout
      [student@servera ~]$ 

   6. Log off from servera.

      [student@servera ~]$ exit
      logout
      Connection to servera closed.
      [student@workstation ~]$