Linux Permission Management Practical

Permission Management Practical - System Administration Best Practices

After learning the basics and advanced concepts of permission management, let's master practical skills. This practical guide will help you acquire professional-level permission management techniques through real-world scenarios, troubleshooting, security best practices, and level-based exercises.

Table of Contents

  1. Real-World Scenarios (Web Development & Server Management)
  2. Troubleshooting and Permission Problem Diagnosis
  3. Security Best Practices
  4. Practical Exercises (3 Difficulty Levels)

1. Real-World Scenarios (Web Development & Server Management)

Learn practical skills through specific permission management applications in real web development and server management scenarios.

๐ŸŽฏ Critical Permission Management Points for Real-World Work

๐ŸŒ Web Development

  • Proper permission settings for web server files
  • Securing configuration files
  • Access control for log files

๐Ÿ–ฅ๏ธ Server Management

  • Protecting system configuration files
  • Permissions for backup files
  • Permission management during deployment

๐ŸŒ Practical Permission Management in Web Development

Scenario 1: File Permission Configuration for LAMP/LEMP Stack

Situation: Set up Apache/Nginx + PHP + MySQL environment on Ubuntu server to run a WordPress site

Requirements: Permission configuration that ensures security while allowing the website to function properly

๐Ÿ”ง Implementation Steps
Step 1: Basic Configuration for Web Root Directory
# Set web root directory owner to www-data
$ sudo chown -R www-data:www-data /var/www/html/

# Set directories to 755, files to 644
$ sudo find /var/www/html -type d -exec chmod 755 {} \;
$ sudo find /var/www/html -type f -exec chmod 644 {} \;

Explanation: Web server can read, maintaining moderate security

Step 2: WordPress-Specific Permission Settings
# wp-config.php contains sensitive info, requires strict protection
$ sudo chmod 600 /var/www/html/wp-config.php
$ sudo chown www-data:www-data /var/www/html/wp-config.php

# uploads directory needs to be writable
$ sudo chmod 755 /var/www/html/wp-content/uploads/
$ sudo chown -R www-data:www-data /var/www/html/wp-content/uploads/

# Plugin and theme directories
$ sudo chmod 755 /var/www/html/wp-content/plugins/
$ sudo chmod 755 /var/www/html/wp-content/themes/
Step 3: Developer Access Configuration
# Create developer group
$ sudo groupadd webdevs

# Add developers to group
$ sudo usermod -a -G webdevs alice
$ sudo usermod -a -G webdevs bob

# Allow webdevs group to edit www-data group files
$ sudo usermod -a -G www-data alice
$ sudo usermod -a -G www-data bob

# Set default group for new files to www-data
$ sudo chmod g+s /var/www/html/
โœ… Best Practices for This Scenario
  • Sensitive Files: wp-config.php at 600 (owner only)
  • General Files: HTML/CSS/JS at 644 (readable)
  • Upload Directory: 755 (writable but not executable)
  • Group Settings: SGID for efficient collaboration

Scenario 2: Node.js Application Deployment Permissions

Situation: Deploy Node.js application to production environment using PM2

Requirements: Ensure security while allowing automated deployment from CI/CD pipeline

๐Ÿ”ง Implementation Steps
Step 1: Application User and Directory Setup
# Create dedicated application user
$ sudo useradd -r -s /bin/bash -d /opt/myapp myapp

# Create application directory and set permissions
$ sudo mkdir -p /opt/myapp
$ sudo chown myapp:myapp /opt/myapp
$ sudo chmod 755 /opt/myapp
Step 2: Deployment Group Configuration
# Create deployment group
$ sudo groupadd deployers

# Add CI/CD user and app user
$ sudo usermod -a -G deployers cicd-user
$ sudo usermod -a -G deployers myapp

# Make app directory operable by deployers
$ sudo chown myapp:deployers /opt/myapp
$ sudo chmod 775 /opt/myapp
$ sudo chmod g+s /opt/myapp
Step 3: Log and PID File Permissions
# Create log directory
$ sudo mkdir -p /var/log/myapp
$ sudo chown myapp:deployers /var/log/myapp
$ sudo chmod 750 /var/log/myapp

# PID file directory
$ sudo mkdir -p /var/run/myapp
$ sudo chown myapp:myapp /var/run/myapp
$ sudo chmod 755 /var/run/myapp
Step 4: Sensitive Files Like SSL Certificates
# SSL certificate directory
$ sudo mkdir -p /opt/myapp/ssl
$ sudo chown root:myapp /opt/myapp/ssl
$ sudo chmod 750 /opt/myapp/ssl

# Strictly protect private key
$ sudo chmod 640 /opt/myapp/ssl/private.key
$ sudo chown root:myapp /opt/myapp/ssl/private.key

๐Ÿ–ฅ๏ธ Practical Permission Management in Server Management

Scenario 3: Backup Script and File Permissions

Situation: Build automated backup system for databases and files

Requirements: Ensure security while enabling scheduled execution and access control

๐Ÿ”ง Implementation Steps
Step 1: Backup User and Directory
# Create dedicated backup user
$ sudo useradd -r -s /bin/bash backup-user

# Create backup directory
$ sudo mkdir -p /backup/{database,files}
$ sudo chown -R backup-user:backup-user /backup
$ sudo chmod 700 /backup  # Only owner can access
Step 2: Backup Script Permissions
# Create backup script and set permissions
$ sudo chmod 750 /opt/scripts/backup.sh
$ sudo chown backup-user:root /opt/scripts/backup.sh

# Protect config file (contains database credentials)
$ sudo chmod 600 /opt/scripts/backup.conf
$ sudo chown backup-user:backup-user /opt/scripts/backup.conf
Step 3: Log Rotation and Auditing
# Backup log directory
$ sudo mkdir -p /var/log/backup
$ sudo chown backup-user:adm /var/log/backup
$ sudo chmod 750 /var/log/backup

# Grant read permission to adm group for admin auditing

Scenario 4: Hierarchical Permission Management for System Configuration Files

Situation: Separate management permissions for system configuration files across multiple administrator levels

Requirements: Hierarchical access control based on security levels

๐Ÿ”ง Implementation Steps
Step 1: Create Administrator Level Groups
# Create hierarchical admin groups
$ sudo groupadd sys-admins      # System admins (highest privilege)
$ sudo groupadd net-admins      # Network admins
$ sudo groupadd app-admins      # Application admins
$ sudo groupadd read-only-ops   # Read-only operators

# Place users in appropriate groups
$ sudo usermod -a -G sys-admins alice    # System admin
$ sudo usermod -a -G net-admins bob      # Network admin
$ sudo usermod -a -G app-admins charlie  # App admin
Step 2: Configuration File Permission Separation
# Critical system config (sys-admins only)
$ sudo chown root:sys-admins /etc/shadow
$ sudo chmod 640 /etc/shadow

# Network config (up to net-admins)
$ sudo chown root:net-admins /etc/netplan/
$ sudo chmod 750 /etc/netplan/
$ sudo find /etc/netplan/ -type f -exec chmod 640 {} \;

# Application config (up to app-admins)
$ sudo chown root:app-admins /etc/nginx/
$ sudo chmod 750 /etc/nginx/
$ sudo find /etc/nginx/ -type f -exec chmod 644 {} \;
Step 3: Audit Log Permissions
# System audit logs (all admins can read)
$ sudo chown root:read-only-ops /var/log/audit/
$ sudo chmod 750 /var/log/audit/
$ sudo find /var/log/audit/ -type f -exec chmod 640 {} \;

๐Ÿค– Automation & CI/CD Permission Management Considerations

๐Ÿ“ฆ Deployment Automation

  • Deployment Service Account: Grant minimum privileges to dedicated user
  • sudo Configuration: Allow specific commands only with NOPASSWD
  • Artifact Permissions: Proper permission settings for deployed files
sudoers Configuration Example:
# /etc/sudoers.d/deploy-user
deploy-user ALL=(www-data) NOPASSWD: /bin/chown, /bin/chmod
deploy-user ALL=(root) NOPASSWD: /bin/systemctl reload nginx

๐Ÿ”„ Configuration Management Tools (Ansible/Chef, etc.)

  • Idempotency: Safe re-execution of permission settings
  • Template Management: Automatic permission settings for config files
  • State Verification: Automated permission checks after deployment

๐Ÿ” Monitoring & Alerts

  • Permission Change Monitoring: Alert on permission changes to critical files
  • Regular Audits: Detect unexpected permission changes
  • Compliance: Verify adherence to security standards

๐Ÿ“‹ Practical Checklists

๐ŸŒ Web Development Deployment

  • โ–ก Can web server process read files?
  • โ–ก Are sensitive config files at 600 permission?
  • โ–ก Is execute permission disabled for upload directories?
  • โ–ก Are log file permissions appropriate?
  • โ–ก Are backup files protected?

๐Ÿ–ฅ๏ธ Server Configuration

  • โ–ก Are system file owners correct?
  • โ–ก Are SSH key permissions 600/700?
  • โ–ก Are sudo privileges minimally restricted?
  • โ–ก Are service users dedicated accounts?
  • โ–ก Are log retention periods and access rights appropriate?

2. Troubleshooting and Permission Problem Diagnosis

Permission-related problems can become complex. Master systematic diagnostic procedures and effective resolution methods to solve problems quickly.

๐Ÿ” Systematic Diagnostic Framework for Permission Problems

Step 1: Understanding Current State (Information Gathering)

# Collect basic permission information
$ ls -la /path/to/problematic/file
$ stat /path/to/problematic/file
$ id current-user
$ groups current-user

Check Points: File permissions, owner, accessing user's group info

Step 2: Access Path Analysis

# Check permissions on directory hierarchy
$ namei -l /path/to/problematic/file

# Identify process execution user
$ ps aux | grep process-name

Check Points: Directory execute permissions, all permissions in the path

Step 3: Permission Calculation and Analysis

# Analyze effective permissions
$ test -r /path/to/file && echo "readable" || echo "not readable"
$ test -w /path/to/file && echo "writable" || echo "not writable"
$ test -x /path/to/file && echo "executable" || echo "not executable"

Check Points: Compare theoretical permissions with actual accessibility

๐Ÿšจ Common Permission Problems and Solution Patterns

๐ŸŒ Web Application Related Problems

โŒ Problem: "403 Forbidden" Error Occurs

Symptom: 403 error appears when accessing website

Common Causes:

  • Web server cannot read files (insufficient permissions)
  • Directory lacks execute permission
  • No index.html or insufficient permissions
โœ… Diagnostic & Resolution Steps
  1. Check Web Server Process User
    $ ps aux | grep -E "(apache|nginx|httpd)"
    # Example: Confirm it's running as www-data user
  2. Check File & Directory Permissions
    $ namei -l /var/www/html/index.html
    # Check permissions on all directories in the path
  3. Fix to Appropriate Permissions
    # Grant execute permission to directory
    $ sudo chmod 755 /var/www/html/
    
    # Grant read permission to file
    $ sudo chmod 644 /var/www/html/index.html
    
    # Change owner to www-data
    $ sudo chown -R www-data:www-data /var/www/html/
โŒ Problem: File Upload Fails

Symptom: File upload function in web application fails

โœ… Diagnostic & Resolution Steps
  1. Check Upload Directory Write Permission
    $ ls -ld /var/www/html/uploads/
    $ sudo -u www-data test -w /var/www/html/uploads/ && echo "writable" || echo "not writable"
  2. Fix Permissions
    $ sudo chown www-data:www-data /var/www/html/uploads/
    $ sudo chmod 755 /var/www/html/uploads/  # Disable execute for security

๐Ÿ” SSH & Authentication Related Problems

โŒ Problem: SSH Key Authentication Fails

Symptom: Cannot connect via SSH with "Permission denied (publickey)" error

โœ… Diagnostic & Resolution Steps
  1. Check SSH Key File Permissions
    $ ls -la ~/.ssh/
    # Check these permissions:
    # drwx------ ~/.ssh/           (700)
    # -rw------- ~/.ssh/id_rsa     (600)
    # -rw-r--r-- ~/.ssh/id_rsa.pub (644)
    # -rw------- ~/.ssh/authorized_keys (600)
  2. Fix Permissions
    $ chmod 700 ~/.ssh/
    $ chmod 600 ~/.ssh/id_rsa
    $ chmod 644 ~/.ssh/id_rsa.pub
    $ chmod 600 ~/.ssh/authorized_keys
  3. Check Server Side (Remote Server)
    # Check on remote server
    $ chmod 700 ~/.ssh/
    $ chmod 600 ~/.ssh/authorized_keys

๐Ÿ’พ Database & File Related Problems

โŒ Problem: Database Connection Error

Symptom: Application cannot connect to database

โœ… Diagnostic & Resolution Steps
  1. Check Configuration File Permissions
    $ ls -la /etc/mysql/mysql.conf.d/mysqld.cnf
    $ ls -la /path/to/app/config/database.conf
  2. Check Database Files & Directory Permissions
    $ ls -la /var/lib/mysql/
    $ sudo -u mysql test -r /var/lib/mysql/ && echo "readable" || echo "not readable"
  3. Fix Permissions
    # MySQL data directory
    $ sudo chown -R mysql:mysql /var/lib/mysql/
    $ sudo chmod 755 /var/lib/mysql/
    $ sudo chmod 660 /var/lib/mysql/*

๐Ÿ› ๏ธ Permission Diagnostic Tools and Command Reference

๐Ÿ“‹ Basic Diagnostic Commands

Command Purpose Output Example
ls -la file Basic permission info -rw-r--r-- 1 user group 1234 file
stat file Detailed permission info Access: (0644/-rw-r--r--)
namei -l path All permissions in path Permission display per path element
id user User information uid=1000(user) gid=1000(user) groups=...

๐Ÿ” Advanced Diagnostic Tools

Accessibility Testing
# Test access as specific user
$ sudo -u www-data test -r /var/www/html/config.php && echo "OK" || echo "NG"

# Test each permission individually
$ [ -r "$file" ] && echo "readable"
$ [ -w "$file" ] && echo "writable"
$ [ -x "$file" ] && echo "executable"
Process & File Investigation
# Check files opened by process
$ sudo lsof -p process-id

# Check process execution user and group
$ ps -o pid,user,group,comm process-id

๐Ÿ›ก๏ธ Permission Problem Prevention Strategies

๐Ÿ“ Configuration Management

  • Permission Documentation: Document standard permission patterns
  • Configuration Templates: Script commonly used permission settings
  • Checklists: Create permission check items for deployment
Permission Script Example:
#!/bin/bash
# set-web-permissions.sh
find "$1" -type d -exec chmod 755 {} \;
find "$1" -type f -exec chmod 644 {} \;
chown -R www-data:www-data "$1"

๐Ÿ”„ Regular Audits

  • Permission Change Monitoring: Log permission changes on critical files
  • Regular Checks: Weekly permission setting verification
  • Anomaly Detection: Alert on unexpected permission settings
Permission Audit Script Example:
#!/bin/bash
# audit-permissions.sh
find /var/www -type f -perm 777 -ls  # Detect dangerous 777 permissions
find /etc -type f ! -user root -ls   # Detect non-root config files

๐ŸŽ“ Team Education

  • Best Practice Sharing: Create permission setting guidelines
  • Review Process: Conduct code reviews for permission changes
  • Incident Analysis: Analyze and improve permission problem causes

3. Security Best Practices

๐Ÿ”’ Principle of Least Privilege

Grant only the minimum necessary permissions.

$ chmod 600 ~/.ssh/id_rsa    # Private key: owner only
$ chmod 644 ~/.ssh/id_rsa.pub # Public key: readable

๐Ÿ”’ Avoid 777 Permissions

Giving full access to all users is dangerous.

# Bad example
$ chmod 777 /var/www/html/

# Good example
$ chmod 755 /var/www/html/
$ chown -R www-data:www-data /var/www/html/

๐Ÿ”’ Protect Configuration Files

Properly protect important configuration files.

$ chmod 600 /etc/mysql/my.cnf
$ chmod 600 ~/.bashrc
$ chmod 700 ~/.ssh/

๐Ÿ”’ Regular Permission Audits

Find inappropriate permission settings.

# Search for world-writable files
$ find / -perm -002 -type f 2>/dev/null

# Search for files with SUID bit set
$ find / -perm -4000 2>/dev/null

4. Practical Exercises (3 Difficulty Levels)

These practical exercises help you progressively acquire permission management skills. Master skills useful in real work from basics to advanced.

๐Ÿ“š Exercise Structure

๐ŸŸข Basic Level

Understand basic concepts of permission management and master fundamental commands

  • Check and modify file & directory permissions
  • Change owners and groups
  • Understand numeric and symbolic notation

๐ŸŸก Practical Level

Acquire permission management skills for real development and operations environments

  • Permission settings for web server environments
  • Build group-based collaborative work environments
  • Security-conscious permission design

๐Ÿ”ด Advanced Level

Practice advanced permission management in complex system environments

  • Utilizing special permissions
  • Permission design for large-scale systems
  • Security incident response

๐ŸŸข Basic Level Exercises

Goal: Understand basic concepts of permission management and accurately execute basic commands

Exercise B1: File Permission Verification and Basic Modification

๐Ÿ“ Assignment

Check and modify file permissions following these steps to understand the meaning of permissions.

๐Ÿ”ง Execution Steps
  1. Create Working File
    # Create exercise file
    $ echo "Hello Linux Permissions!" > test_file.txt
    $ ls -l test_file.txt

    Check Point: Verify default permissions (usually 644)

  2. Practice Reading Permissions
    # Check detailed permission info
    $ stat test_file.txt

    Question: What are the permissions for owner, group, and others?

  3. Change Permissions Using Numeric Notation
    # Change to owner read/write only
    $ chmod 600 test_file.txt
    $ ls -l test_file.txt
    
    # Change to readable by all
    $ chmod 644 test_file.txt
    $ ls -l test_file.txt
  4. Change Permissions Using Symbolic Notation
    # Add execute permission for owner
    $ chmod u+x test_file.txt
    $ ls -l test_file.txt
    
    # Remove write permission from group
    $ chmod g-w test_file.txt
    $ ls -l test_file.txt
โœ… Verification Test
  • Can you explain the difference between 644 and 755?
  • What's the difference between chmod u+x and chmod +x?
  • What's the difference in meaning between execute permissions for files vs directories?

๐ŸŸก Practical Level Exercises

Goal: Acquire permission management skills needed in real development and operations environments

Exercise P1: Web Server Environment Permission Configuration

๐Ÿ“ Assignment

Practice appropriate permission settings for hosting a website. Balancing security and functionality is important.

๐ŸŽฏ Scenario

Deploy new website "mycompany.com" to /var/www/html/mycompany/. Need permission settings that allow developers to update and web server to function properly.

๐Ÿ”ง Implementation Steps
  1. Create Project Structure
    # Create directory structure for website
    $ sudo mkdir -p /var/www/html/mycompany/{public,assets,uploads,config}
    $ echo "<h1>Welcome to My Company</h1>" | sudo tee /var/www/html/mycompany/public/index.html
    $ echo "body { font-family: Arial; }" | sudo tee /var/www/html/mycompany/assets/style.css
    $ echo "db_password=secret123" | sudo tee /var/www/html/mycompany/config/database.conf
  2. Set Basic Permissions
    # Set owner to www-data
    $ sudo chown -R www-data:www-data /var/www/html/mycompany/
    
    # Set basic permissions for directories and files
    $ sudo find /var/www/html/mycompany/ -type d -exec chmod 755 {} \;
    $ sudo find /var/www/html/mycompany/ -type f -exec chmod 644 {} \;
  3. Set Special Permissions
    # Upload directory writable but not executable
    $ sudo chmod 755 /var/www/html/mycompany/uploads/
    $ sudo chmod g+w /var/www/html/mycompany/uploads/
    
    # Strictly protect config file
    $ sudo chmod 600 /var/www/html/mycompany/config/database.conf
    
    # Set default group for new files to www-data
    $ sudo chmod g+s /var/www/html/mycompany/
โœ… Verification Test
  1. Web Server Access Test
    # Verify www-data user can read file
    $ sudo -u www-data test -r /var/www/html/mycompany/public/index.html && echo "OK" || echo "NG"
  2. Security Check
    # Verify config file cannot be read by other users
    $ sudo -u nobody test -r /var/www/html/mycompany/config/database.conf && echo "SECURITY RISK" || echo "SECURE"

๐Ÿ”ด Advanced Level Exercises

Goal: Acquire advanced permission management skills for complex system environments

Exercise A1: Secure System Design Using Special Permissions

๐Ÿ“ Assignment

Design a system that balances security and convenience using SUID, SGID, and Sticky Bit appropriately.

๐ŸŽฏ Scenario

Build an environment on a multi-purpose server where general users can safely check system information and collaborate in shared areas.

๐Ÿ”ง Implementation Steps
  1. System Information Access Using SUID
    # Create system information check script
    $ sudo tee /usr/local/bin/system-info << 'EOF'
    #!/bin/bash
    echo "=== System Information ==="
    echo "Hostname: $(hostname)"
    echo "Uptime: $(uptime)"
    echo "Disk Usage:"
    df -h / | tail -1
    echo "Memory Usage:"
    free -h | grep Mem
    EOF
    
    # Set SUID to allow general users to execute
    $ sudo chmod 4755 /usr/local/bin/system-info
    $ sudo chown root:root /usr/local/bin/system-info
  2. Collaborative Work Directory Using SGID
    # Create project shared directory
    $ sudo mkdir -p /shared/projects
    $ sudo groupadd project-users
    $ sudo chown root:project-users /shared/projects
    
    # Set SGID so new files automatically belong to project-users group
    $ sudo chmod 2775 /shared/projects
    
    # Test
    $ echo "Project file" > /shared/projects/test.txt
    $ ls -l /shared/projects/test.txt  # Verify group is project-users
  3. Safe Temporary Area Using Sticky Bit
    # Create safe shared temporary directory
    $ sudo mkdir -p /shared/temp
    $ sudo chmod 1777 /shared/temp    # Sticky bit + writable by all
    
    # Create test file
    $ echo "Temporary file" > /shared/temp/myfile.txt
    $ ls -ld /shared/temp/            # Verify last permission bit is 't'

๐ŸŽฏ Exercise Completion Check

๐ŸŸข Basic Level Completion Criteria

  • โ–ก Can accurately read file & directory permissions
  • โ–ก Can use both numeric and symbolic notation with chmod
  • โ–ก Understand owner and group concepts
  • โ–ก Understand relationship between directory permissions and file access

๐ŸŸก Practical Level Completion Criteria

  • โ–ก Can configure permissions for web server environments
  • โ–ก Can build group-based collaborative work environments
  • โ–ก Can design security-conscious permissions
  • โ–ก Can perform basic troubleshooting of permission problems

๐Ÿ”ด Advanced Level Completion Criteria

  • โ–ก Can appropriately use special permissions (SUID/SGID/Sticky)
  • โ–ก Can audit system-wide permissions
  • โ–ก Can respond to security incidents
  • โ–ก Can design and implement permission problem prevention strategies

Summary

Key Permission Management Points:

  • 3-3-3 Principle: Owner-Group-Others ร— Read-Write-Execute
  • chmod for permissions, chown for ownership
  • Follow the principle of least privilege to ensure security
  • Use special permissions (SUID, SGID, Sticky Bit) with caution

Proper permission management is the first step in system security!

๐ŸŽ‰ Permission Management Master Series Complete!

Great work! Through these three articles, you've become a Linux permission management expert.

Apply the knowledge you've acquired from basics to practical skills to practice safe and efficient system management.

๐Ÿ” Complete Permission Management Series

  1. Basics - Permission mechanisms, risk avoidance, chmod basics
  2. Advanced - chown, group management, umask, special permissions
  3. Practical (This Article) - Real-world scenarios, troubleshooting, security
๐Ÿ“ข About Affiliate Links

As an Amazon Associate, this site earns from qualifying purchases through product links. This is at no additional cost to you. Book recommendations are from Amazon.co.jp (Japan), chosen for their value to Japanese-speaking learners.