Linux Permission Management Practical
After learning the basics and advanced concepts of permission management, let's master practical skills. This practical guide will help you acquire professional-level permission management techniques through real-world scenarios, troubleshooting, security best practices, and level-based exercises.
Table of Contents
1. Real-World Scenarios (Web Development & Server Management)
Learn practical skills through specific permission management applications in real web development and server management scenarios.
๐ฏ Critical Permission Management Points for Real-World Work
๐ Web Development
- Proper permission settings for web server files
- Securing configuration files
- Access control for log files
๐ฅ๏ธ Server Management
- Protecting system configuration files
- Permissions for backup files
- Permission management during deployment
๐ Practical Permission Management in Web Development
Scenario 1: File Permission Configuration for LAMP/LEMP Stack
Situation: Set up Apache/Nginx + PHP + MySQL environment on Ubuntu server to run a WordPress site
Requirements: Permission configuration that ensures security while allowing the website to function properly
๐ง Implementation Steps
Step 1: Basic Configuration for Web Root Directory
# Set web root directory owner to www-data
$ sudo chown -R www-data:www-data /var/www/html/
# Set directories to 755, files to 644
$ sudo find /var/www/html -type d -exec chmod 755 {} \;
$ sudo find /var/www/html -type f -exec chmod 644 {} \;
Explanation: Web server can read, maintaining moderate security
Step 2: WordPress-Specific Permission Settings
# wp-config.php contains sensitive info, requires strict protection $ sudo chmod 600 /var/www/html/wp-config.php $ sudo chown www-data:www-data /var/www/html/wp-config.php # uploads directory needs to be writable $ sudo chmod 755 /var/www/html/wp-content/uploads/ $ sudo chown -R www-data:www-data /var/www/html/wp-content/uploads/ # Plugin and theme directories $ sudo chmod 755 /var/www/html/wp-content/plugins/ $ sudo chmod 755 /var/www/html/wp-content/themes/
Step 3: Developer Access Configuration
# Create developer group $ sudo groupadd webdevs # Add developers to group $ sudo usermod -a -G webdevs alice $ sudo usermod -a -G webdevs bob # Allow webdevs group to edit www-data group files $ sudo usermod -a -G www-data alice $ sudo usermod -a -G www-data bob # Set default group for new files to www-data $ sudo chmod g+s /var/www/html/
โ Best Practices for This Scenario
- Sensitive Files: wp-config.php at 600 (owner only)
- General Files: HTML/CSS/JS at 644 (readable)
- Upload Directory: 755 (writable but not executable)
- Group Settings: SGID for efficient collaboration
Scenario 2: Node.js Application Deployment Permissions
Situation: Deploy Node.js application to production environment using PM2
Requirements: Ensure security while allowing automated deployment from CI/CD pipeline
๐ง Implementation Steps
Step 1: Application User and Directory Setup
# Create dedicated application user $ sudo useradd -r -s /bin/bash -d /opt/myapp myapp # Create application directory and set permissions $ sudo mkdir -p /opt/myapp $ sudo chown myapp:myapp /opt/myapp $ sudo chmod 755 /opt/myapp
Step 2: Deployment Group Configuration
# Create deployment group $ sudo groupadd deployers # Add CI/CD user and app user $ sudo usermod -a -G deployers cicd-user $ sudo usermod -a -G deployers myapp # Make app directory operable by deployers $ sudo chown myapp:deployers /opt/myapp $ sudo chmod 775 /opt/myapp $ sudo chmod g+s /opt/myapp
Step 3: Log and PID File Permissions
# Create log directory $ sudo mkdir -p /var/log/myapp $ sudo chown myapp:deployers /var/log/myapp $ sudo chmod 750 /var/log/myapp # PID file directory $ sudo mkdir -p /var/run/myapp $ sudo chown myapp:myapp /var/run/myapp $ sudo chmod 755 /var/run/myapp
Step 4: Sensitive Files Like SSL Certificates
# SSL certificate directory $ sudo mkdir -p /opt/myapp/ssl $ sudo chown root:myapp /opt/myapp/ssl $ sudo chmod 750 /opt/myapp/ssl # Strictly protect private key $ sudo chmod 640 /opt/myapp/ssl/private.key $ sudo chown root:myapp /opt/myapp/ssl/private.key
๐ฅ๏ธ Practical Permission Management in Server Management
Scenario 3: Backup Script and File Permissions
Situation: Build automated backup system for databases and files
Requirements: Ensure security while enabling scheduled execution and access control
๐ง Implementation Steps
Step 1: Backup User and Directory
# Create dedicated backup user
$ sudo useradd -r -s /bin/bash backup-user
# Create backup directory
$ sudo mkdir -p /backup/{database,files}
$ sudo chown -R backup-user:backup-user /backup
$ sudo chmod 700 /backup # Only owner can access
Step 2: Backup Script Permissions
# Create backup script and set permissions $ sudo chmod 750 /opt/scripts/backup.sh $ sudo chown backup-user:root /opt/scripts/backup.sh # Protect config file (contains database credentials) $ sudo chmod 600 /opt/scripts/backup.conf $ sudo chown backup-user:backup-user /opt/scripts/backup.conf
Step 3: Log Rotation and Auditing
# Backup log directory $ sudo mkdir -p /var/log/backup $ sudo chown backup-user:adm /var/log/backup $ sudo chmod 750 /var/log/backup # Grant read permission to adm group for admin auditing
Scenario 4: Hierarchical Permission Management for System Configuration Files
Situation: Separate management permissions for system configuration files across multiple administrator levels
Requirements: Hierarchical access control based on security levels
๐ง Implementation Steps
Step 1: Create Administrator Level Groups
# Create hierarchical admin groups $ sudo groupadd sys-admins # System admins (highest privilege) $ sudo groupadd net-admins # Network admins $ sudo groupadd app-admins # Application admins $ sudo groupadd read-only-ops # Read-only operators # Place users in appropriate groups $ sudo usermod -a -G sys-admins alice # System admin $ sudo usermod -a -G net-admins bob # Network admin $ sudo usermod -a -G app-admins charlie # App admin
Step 2: Configuration File Permission Separation
# Critical system config (sys-admins only)
$ sudo chown root:sys-admins /etc/shadow
$ sudo chmod 640 /etc/shadow
# Network config (up to net-admins)
$ sudo chown root:net-admins /etc/netplan/
$ sudo chmod 750 /etc/netplan/
$ sudo find /etc/netplan/ -type f -exec chmod 640 {} \;
# Application config (up to app-admins)
$ sudo chown root:app-admins /etc/nginx/
$ sudo chmod 750 /etc/nginx/
$ sudo find /etc/nginx/ -type f -exec chmod 644 {} \;
Step 3: Audit Log Permissions
# System audit logs (all admins can read)
$ sudo chown root:read-only-ops /var/log/audit/
$ sudo chmod 750 /var/log/audit/
$ sudo find /var/log/audit/ -type f -exec chmod 640 {} \;
๐ค Automation & CI/CD Permission Management Considerations
๐ฆ Deployment Automation
- Deployment Service Account: Grant minimum privileges to dedicated user
- sudo Configuration: Allow specific commands only with NOPASSWD
- Artifact Permissions: Proper permission settings for deployed files
sudoers Configuration Example:
# /etc/sudoers.d/deploy-user deploy-user ALL=(www-data) NOPASSWD: /bin/chown, /bin/chmod deploy-user ALL=(root) NOPASSWD: /bin/systemctl reload nginx
๐ Configuration Management Tools (Ansible/Chef, etc.)
- Idempotency: Safe re-execution of permission settings
- Template Management: Automatic permission settings for config files
- State Verification: Automated permission checks after deployment
๐ Monitoring & Alerts
- Permission Change Monitoring: Alert on permission changes to critical files
- Regular Audits: Detect unexpected permission changes
- Compliance: Verify adherence to security standards
๐ Practical Checklists
๐ Web Development Deployment
- โก Can web server process read files?
- โก Are sensitive config files at 600 permission?
- โก Is execute permission disabled for upload directories?
- โก Are log file permissions appropriate?
- โก Are backup files protected?
๐ฅ๏ธ Server Configuration
- โก Are system file owners correct?
- โก Are SSH key permissions 600/700?
- โก Are sudo privileges minimally restricted?
- โก Are service users dedicated accounts?
- โก Are log retention periods and access rights appropriate?
2. Troubleshooting and Permission Problem Diagnosis
Permission-related problems can become complex. Master systematic diagnostic procedures and effective resolution methods to solve problems quickly.
๐ Systematic Diagnostic Framework for Permission Problems
Step 1: Understanding Current State (Information Gathering)
# Collect basic permission information $ ls -la /path/to/problematic/file $ stat /path/to/problematic/file $ id current-user $ groups current-user
Check Points: File permissions, owner, accessing user's group info
Step 2: Access Path Analysis
# Check permissions on directory hierarchy $ namei -l /path/to/problematic/file # Identify process execution user $ ps aux | grep process-name
Check Points: Directory execute permissions, all permissions in the path
Step 3: Permission Calculation and Analysis
# Analyze effective permissions $ test -r /path/to/file && echo "readable" || echo "not readable" $ test -w /path/to/file && echo "writable" || echo "not writable" $ test -x /path/to/file && echo "executable" || echo "not executable"
Check Points: Compare theoretical permissions with actual accessibility
๐จ Common Permission Problems and Solution Patterns
๐ Web Application Related Problems
โ Problem: "403 Forbidden" Error Occurs
Symptom: 403 error appears when accessing website
Common Causes:
- Web server cannot read files (insufficient permissions)
- Directory lacks execute permission
- No index.html or insufficient permissions
โ Diagnostic & Resolution Steps
- Check Web Server Process User
$ ps aux | grep -E "(apache|nginx|httpd)" # Example: Confirm it's running as www-data user
- Check File & Directory Permissions
$ namei -l /var/www/html/index.html # Check permissions on all directories in the path
- Fix to Appropriate Permissions
# Grant execute permission to directory $ sudo chmod 755 /var/www/html/ # Grant read permission to file $ sudo chmod 644 /var/www/html/index.html # Change owner to www-data $ sudo chown -R www-data:www-data /var/www/html/
โ Problem: File Upload Fails
Symptom: File upload function in web application fails
โ Diagnostic & Resolution Steps
- Check Upload Directory Write Permission
$ ls -ld /var/www/html/uploads/ $ sudo -u www-data test -w /var/www/html/uploads/ && echo "writable" || echo "not writable"
- Fix Permissions
$ sudo chown www-data:www-data /var/www/html/uploads/ $ sudo chmod 755 /var/www/html/uploads/ # Disable execute for security
๐ SSH & Authentication Related Problems
โ Problem: SSH Key Authentication Fails
Symptom: Cannot connect via SSH with "Permission denied (publickey)" error
โ Diagnostic & Resolution Steps
- Check SSH Key File Permissions
$ ls -la ~/.ssh/ # Check these permissions: # drwx------ ~/.ssh/ (700) # -rw------- ~/.ssh/id_rsa (600) # -rw-r--r-- ~/.ssh/id_rsa.pub (644) # -rw------- ~/.ssh/authorized_keys (600)
- Fix Permissions
$ chmod 700 ~/.ssh/ $ chmod 600 ~/.ssh/id_rsa $ chmod 644 ~/.ssh/id_rsa.pub $ chmod 600 ~/.ssh/authorized_keys
- Check Server Side (Remote Server)
# Check on remote server $ chmod 700 ~/.ssh/ $ chmod 600 ~/.ssh/authorized_keys
๐พ Database & File Related Problems
โ Problem: Database Connection Error
Symptom: Application cannot connect to database
โ Diagnostic & Resolution Steps
- Check Configuration File Permissions
$ ls -la /etc/mysql/mysql.conf.d/mysqld.cnf $ ls -la /path/to/app/config/database.conf
- Check Database Files & Directory Permissions
$ ls -la /var/lib/mysql/ $ sudo -u mysql test -r /var/lib/mysql/ && echo "readable" || echo "not readable"
- Fix Permissions
# MySQL data directory $ sudo chown -R mysql:mysql /var/lib/mysql/ $ sudo chmod 755 /var/lib/mysql/ $ sudo chmod 660 /var/lib/mysql/*
๐ ๏ธ Permission Diagnostic Tools and Command Reference
๐ Basic Diagnostic Commands
| Command | Purpose | Output Example |
|---|---|---|
ls -la file |
Basic permission info | -rw-r--r-- 1 user group 1234 file |
stat file |
Detailed permission info | Access: (0644/-rw-r--r--) |
namei -l path |
All permissions in path | Permission display per path element |
id user |
User information | uid=1000(user) gid=1000(user) groups=... |
๐ Advanced Diagnostic Tools
Accessibility Testing
# Test access as specific user $ sudo -u www-data test -r /var/www/html/config.php && echo "OK" || echo "NG" # Test each permission individually $ [ -r "$file" ] && echo "readable" $ [ -w "$file" ] && echo "writable" $ [ -x "$file" ] && echo "executable"
Process & File Investigation
# Check files opened by process $ sudo lsof -p process-id # Check process execution user and group $ ps -o pid,user,group,comm process-id
๐ก๏ธ Permission Problem Prevention Strategies
๐ Configuration Management
- Permission Documentation: Document standard permission patterns
- Configuration Templates: Script commonly used permission settings
- Checklists: Create permission check items for deployment
Permission Script Example:
#!/bin/bash
# set-web-permissions.sh
find "$1" -type d -exec chmod 755 {} \;
find "$1" -type f -exec chmod 644 {} \;
chown -R www-data:www-data "$1"
๐ Regular Audits
- Permission Change Monitoring: Log permission changes on critical files
- Regular Checks: Weekly permission setting verification
- Anomaly Detection: Alert on unexpected permission settings
Permission Audit Script Example:
#!/bin/bash # audit-permissions.sh find /var/www -type f -perm 777 -ls # Detect dangerous 777 permissions find /etc -type f ! -user root -ls # Detect non-root config files
๐ Team Education
- Best Practice Sharing: Create permission setting guidelines
- Review Process: Conduct code reviews for permission changes
- Incident Analysis: Analyze and improve permission problem causes
3. Security Best Practices
๐ Principle of Least Privilege
Grant only the minimum necessary permissions.
$ chmod 600 ~/.ssh/id_rsa # Private key: owner only $ chmod 644 ~/.ssh/id_rsa.pub # Public key: readable
๐ Avoid 777 Permissions
Giving full access to all users is dangerous.
# Bad example $ chmod 777 /var/www/html/ # Good example $ chmod 755 /var/www/html/ $ chown -R www-data:www-data /var/www/html/
๐ Protect Configuration Files
Properly protect important configuration files.
$ chmod 600 /etc/mysql/my.cnf $ chmod 600 ~/.bashrc $ chmod 700 ~/.ssh/
๐ Regular Permission Audits
Find inappropriate permission settings.
# Search for world-writable files $ find / -perm -002 -type f 2>/dev/null # Search for files with SUID bit set $ find / -perm -4000 2>/dev/null
4. Practical Exercises (3 Difficulty Levels)
These practical exercises help you progressively acquire permission management skills. Master skills useful in real work from basics to advanced.
๐ Exercise Structure
๐ข Basic Level
Understand basic concepts of permission management and master fundamental commands
- Check and modify file & directory permissions
- Change owners and groups
- Understand numeric and symbolic notation
๐ก Practical Level
Acquire permission management skills for real development and operations environments
- Permission settings for web server environments
- Build group-based collaborative work environments
- Security-conscious permission design
๐ด Advanced Level
Practice advanced permission management in complex system environments
- Utilizing special permissions
- Permission design for large-scale systems
- Security incident response
๐ข Basic Level Exercises
Goal: Understand basic concepts of permission management and accurately execute basic commands
Exercise B1: File Permission Verification and Basic Modification
๐ Assignment
Check and modify file permissions following these steps to understand the meaning of permissions.
๐ง Execution Steps
- Create Working File
# Create exercise file $ echo "Hello Linux Permissions!" > test_file.txt $ ls -l test_file.txt
Check Point: Verify default permissions (usually 644)
- Practice Reading Permissions
# Check detailed permission info $ stat test_file.txt
Question: What are the permissions for owner, group, and others?
- Change Permissions Using Numeric Notation
# Change to owner read/write only $ chmod 600 test_file.txt $ ls -l test_file.txt # Change to readable by all $ chmod 644 test_file.txt $ ls -l test_file.txt
- Change Permissions Using Symbolic Notation
# Add execute permission for owner $ chmod u+x test_file.txt $ ls -l test_file.txt # Remove write permission from group $ chmod g-w test_file.txt $ ls -l test_file.txt
โ Verification Test
- Can you explain the difference between 644 and 755?
- What's the difference between
chmod u+xandchmod +x? - What's the difference in meaning between execute permissions for files vs directories?
๐ก Practical Level Exercises
Goal: Acquire permission management skills needed in real development and operations environments
Exercise P1: Web Server Environment Permission Configuration
๐ Assignment
Practice appropriate permission settings for hosting a website. Balancing security and functionality is important.
๐ฏ Scenario
Deploy new website "mycompany.com" to /var/www/html/mycompany/. Need permission settings that allow developers to update and web server to function properly.
๐ง Implementation Steps
- Create Project Structure
# Create directory structure for website $ sudo mkdir -p /var/www/html/mycompany/{public,assets,uploads,config} $ echo "<h1>Welcome to My Company</h1>" | sudo tee /var/www/html/mycompany/public/index.html $ echo "body { font-family: Arial; }" | sudo tee /var/www/html/mycompany/assets/style.css $ echo "db_password=secret123" | sudo tee /var/www/html/mycompany/config/database.conf - Set Basic Permissions
# Set owner to www-data $ sudo chown -R www-data:www-data /var/www/html/mycompany/ # Set basic permissions for directories and files $ sudo find /var/www/html/mycompany/ -type d -exec chmod 755 {} \; $ sudo find /var/www/html/mycompany/ -type f -exec chmod 644 {} \; - Set Special Permissions
# Upload directory writable but not executable $ sudo chmod 755 /var/www/html/mycompany/uploads/ $ sudo chmod g+w /var/www/html/mycompany/uploads/ # Strictly protect config file $ sudo chmod 600 /var/www/html/mycompany/config/database.conf # Set default group for new files to www-data $ sudo chmod g+s /var/www/html/mycompany/
โ Verification Test
- Web Server Access Test
# Verify www-data user can read file $ sudo -u www-data test -r /var/www/html/mycompany/public/index.html && echo "OK" || echo "NG"
- Security Check
# Verify config file cannot be read by other users $ sudo -u nobody test -r /var/www/html/mycompany/config/database.conf && echo "SECURITY RISK" || echo "SECURE"
๐ด Advanced Level Exercises
Goal: Acquire advanced permission management skills for complex system environments
Exercise A1: Secure System Design Using Special Permissions
๐ Assignment
Design a system that balances security and convenience using SUID, SGID, and Sticky Bit appropriately.
๐ฏ Scenario
Build an environment on a multi-purpose server where general users can safely check system information and collaborate in shared areas.
๐ง Implementation Steps
- System Information Access Using SUID
# Create system information check script $ sudo tee /usr/local/bin/system-info << 'EOF' #!/bin/bash echo "=== System Information ===" echo "Hostname: $(hostname)" echo "Uptime: $(uptime)" echo "Disk Usage:" df -h / | tail -1 echo "Memory Usage:" free -h | grep Mem EOF # Set SUID to allow general users to execute $ sudo chmod 4755 /usr/local/bin/system-info $ sudo chown root:root /usr/local/bin/system-info
- Collaborative Work Directory Using SGID
# Create project shared directory $ sudo mkdir -p /shared/projects $ sudo groupadd project-users $ sudo chown root:project-users /shared/projects # Set SGID so new files automatically belong to project-users group $ sudo chmod 2775 /shared/projects # Test $ echo "Project file" > /shared/projects/test.txt $ ls -l /shared/projects/test.txt # Verify group is project-users
- Safe Temporary Area Using Sticky Bit
# Create safe shared temporary directory $ sudo mkdir -p /shared/temp $ sudo chmod 1777 /shared/temp # Sticky bit + writable by all # Create test file $ echo "Temporary file" > /shared/temp/myfile.txt $ ls -ld /shared/temp/ # Verify last permission bit is 't'
๐ฏ Exercise Completion Check
๐ข Basic Level Completion Criteria
- โก Can accurately read file & directory permissions
- โก Can use both numeric and symbolic notation with chmod
- โก Understand owner and group concepts
- โก Understand relationship between directory permissions and file access
๐ก Practical Level Completion Criteria
- โก Can configure permissions for web server environments
- โก Can build group-based collaborative work environments
- โก Can design security-conscious permissions
- โก Can perform basic troubleshooting of permission problems
๐ด Advanced Level Completion Criteria
- โก Can appropriately use special permissions (SUID/SGID/Sticky)
- โก Can audit system-wide permissions
- โก Can respond to security incidents
- โก Can design and implement permission problem prevention strategies
Summary
Key Permission Management Points:
- 3-3-3 Principle: Owner-Group-Others ร Read-Write-Execute
- chmod for permissions, chown for ownership
- Follow the principle of least privilege to ensure security
- Use special permissions (SUID, SGID, Sticky Bit) with caution
Proper permission management is the first step in system security!
๐ Permission Management Master Series Complete!
Great work! Through these three articles, you've become a Linux permission management expert.
Apply the knowledge you've acquired from basics to practical skills to practice safe and efficient system management.
๐ Complete Permission Management Series
As an Amazon Associate, this site earns from qualifying purchases through product links. This is at no additional cost to you. Book recommendations are from Amazon.co.jp (Japan), chosen for their value to Japanese-speaking learners.
๐ Recommended Books for Permission Management Practice & System Administration Learning
To efficiently master practical permission management skills and real-world scenarios, we've carefully selected server operations and system administration practice books. Deepen your knowledge of security, troubleshooting, and operational know-how.
๐ Linuxใตใผใใผใปใญใฅใชใใฃๅพนๅบๅ ฅ้ ใชใผใใณใฝใผในใซใใใตใผใใผ้ฒ่กใฎๅบๆฌ
Target Level: Intermediate to Advanced
Detailed explanations of security-conscious permission management practical techniques. A practice book that systematically teaches essential security knowledge for real work like firewalls, SSL, permission design, and vulnerability countermeasures. A must-read for server administrators.
๐ ใผใญใใใฏใใใLinuxใตใผใใผๆง็ฏใป้็จใฌใคใ ็ฌฌ2็
Target Level: Beginner to Intermediate
Practical guide for server construction and permission configuration based on real-world scenarios. Covers frequently occurring situations in the field like web development, backups, and deployment. Optimal material for beginners to acquire practical skills.
๐ Linuxใทในใใ ็ฎก็ๆจๆบๆ็งๆธ
Target Level: Beginner to Intermediate
Systematically learn practical basics of permission management, user management, and system auditing. Official material by LPI-Japan, useful for both real work and LinuC certification preparation. Optimal for those aiming to progressively become permission management experts.
๐ 24ๆ้365ๆฅ ใตใผใ/ใคใณใใฉใๆฏใใๆ่ก
Target Level: Intermediate to Advanced
Learn know-how for permission management, operation automation, and troubleshooting in large-scale server environments from real examples. Master advanced operational techniques that will make you immediately effective in real work, including continuous monitoring, security audits, and incident response.