Cyberstudy
Supplementary — not from your PDF Intermediate ~45 min

Apply least privilege on Linux

Create users and groups in a practice VM, lock down a shared folder, and give one user a single narrowly scoped sudo permission.

Environment

A Linux virtual machine you own (e.g. Ubuntu in VirtualBox) with a user that has sudo.

Before you start

  • Read Least Privilege Permission Assignments (p.95), DAC and MAC (p.92) and Privileged Access Management (p.100).

You will

  • Create users and groups
  • Set owner, group and permission bits
  • Grant one sudo command instead of full admin rights

Steps

  1. 1

    Create two users: sudo adduser alice and sudo adduser bob.

  2. 2

    Create a group and add Alice: sudo groupadd finance, then sudo usermod -aG finance alice.

  3. 3

    Make a shared folder: sudo mkdir /srv/finance, sudo chown root:finance /srv/finance, sudo chmod 770 /srv/finance.

  4. 4

    Test it: sudo -u alice touch /srv/finance/q3.txt should work; sudo -u bob ls /srv/finance should be denied.

  5. 5

    Run sudo visudo -f /etc/sudoers.d/bob and add bob ALL=(root) /usr/bin/systemctl restart ssh. Bob can now restart SSH and nothing else.

  6. 6

    Check with sudo -l -U bob, then confirm Bob can't run other commands as root.

  7. 7

    Run ls -l /srv and explain each part of the permission string.

Check your understanding

  • ?Is Linux file ownership an example of DAC or MAC? Why?
  • ?Why is one narrowly scoped sudo rule safer than adding Bob to the sudo group?
  • ?How would you review these permissions regularly?