Linux TCP/IP networking: net-tools vs. iproute2 – Linux FAQ

Linux TCP/IP networking: net-tools vs. iproute2 – Linux FAQ.

via Linux TCP/IP networking: net-tools vs. iproute2 – Linux FAQ.

A Google Site Meant to Protect You Is Helping Hackers Attack You | Threat Level | WIRED

A Google Site Meant to Protect You Is Helping Hackers Attack You | Threat Level | WIRED.

via A Google Site Meant to Protect You Is Helping Hackers Attack You | Threat Level | WIRED.

OpenWRT adds IPv6, preps for IoT future ·  LinuxGizmos.com

[object Window]

via OpenWRT adds IPv6, preps for IoT future ·  LinuxGizmos.com.

ipv6 part2: soho ipv6

In this series for small office and home office (soho) I will discuss connecting via ipv6 to the outside world, and back.
In this 2nd post, I will look at ipv6 in my linux machines.

There are 3 desktops and as many laptops in my network, all running one or the other Debian like distro. Regardless, what I will talk about in this post should be similar to most linux distros. I realize that this is a highly technical post. The most important thing is that you try some or many of the things in this post for yourself. A practical approach is the best to learn: you ask yourself questions, next, you’re bound to look for answers.

ipv6 on my desktop

3 years ago, we had a world wide ipv6 day: On 8 June, 2011, top websites and Internet service providers around the world, including Google, Facebook, Yahoo!, Akamai and Limelight Networks joined together with more than 1000 other participating websites in World IPv6 Day for a successful global scale trial of the new Internet Protocol, IPv6.

I’m sure that this was not the first, neither the last ipv6 day, but it was the first that caught my attention. With 3 people, we did some experiments that day, involving windows and linux machines. Unfortunately, our first steps were on a Link local ipv6 network only, and such a network is not representative for the ipv6 internet. I will talk about link-local networks at the end of the series, but now only mention them when they appear without going deeper.
In January 2014, mysteriously ipv6 global links appeared out of nothing: my provider was rolling out ipv6.

hands on

No network-manager enabled, No avahi-daemon.
The most simple configuration in /etc/network/interfaces

bert@lx24:~$ cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth1
iface eth1 inet dhcp

Starting with no cable attached and a two minutes waiting time for the network (not to come up), we get the following situation:

bert@lx24:~$ ifconfig
eth1 Link encap:Ethernet HWaddr 08:00:27:07:b6:19
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
‌
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0

Notice that this machine is ipv6 enabled, the local loopback address ::1 is configured for ipv6. Any linux kernel from 2.6 onwards (and some even before), are ipv6 ready. Unless you still have a SuSE-Linux-9.0 from 2004 running you should be ok;
The /128 means that ::1 sits in its own address space. In ipv4 it would look like a /32.

As soon as we connect a network cable, the situation changes.

I first connect to a network without ipv6 access (ipv4 only):

bert@lx24:~$ ifconfig
eth1 Link encap:Ethernet HWaddr 08:00:27:07:b6:19
inet addr:10.0.0.74 Bcast:10.0.0.255 Mask:255.255.255.0
inet6 addr: fe80::a00:27ff:fe07:b619/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:462 errors:0 dropped:0 overruns:0 frame:0
TX packets:182 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:69963 (69.9 KB) TX bytes:24713 (24.7 KB)
‍
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:72 errors:0 dropped:0 overruns:0 frame:0
TX packets:72 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:5632 (5.6 KB) TX bytes:5632 (5.6 KB)

We get ipv4 addresses but in ipv6 we only get a Link-local address. We already had a loopback address.
If we look at the link local address we notice a /64. The first 64 bits or 16 hexes are network identifier, the next 16 hexes should be unique host-addresses in the entire network. I underlined the part of the mac address that is repeated in the ipv6 address. If MAC-addresses are unique (and they are), your Link-local addresses are also unique.

Now I connect the same network adapter to an ipv6/ipv4 network:

bert@lx24:~$ ifconfig
eth1 Link encap:Ethernet HWaddr 08:00:27:07:b6:19
inet addr:10.0.1.150 Bcast:10.0.1.255 Mask:255.255.255.0
inet6 addr: fe80::a00:27ff:fe07:b619/64 Scope:Link
inet6 addr: 2a02:1811:e100:e100:a9cc:a9c8:c2bb:f335/64 Scope:Global
inet6 addr: 2a02:1811:e100:e100:a00:27ff:fe07:b619/64 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:530 errors:0 dropped:0 overruns:0 frame:0
TX packets:233 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:82428 (82.4 KB) TX bytes:33056 (33.0 KB)
‍
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:188 errors:0 dropped:0 overruns:0 frame:0
TX packets:188 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:14880 (14.8 KB) TX bytes:14880 (14.8 KB)

Almost immediately I get two global ipv6 addresses. Only minutes later the ipv4 addresses appear.

This raises some questions:

  • Why are there two ipv6 GLOBAL addresses and not one?
  • How does my system find the right subnet,
    and from where does it get an answer?
  • Did I get a default ipv6 gateway?
  • How and Whom can I ping?

Why are there two ipv6 GLOBAL addresses and not one?

Instead of using ‘ifconfig‘, I will use the ‘ip addr‘ command. Slowly but surely the older familiar commands are replaced by newer ones. The ‘ip’ command set is different, but more powerfull. Let’s use this hidden powers to analyze the ipv6 configuration:

bert@lx24:~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 08:00:27:07:b6:19 brd ff:ff:ff:ff:ff:ff
inet 10.0.1.150/24 brd 10.0.1.255 scope global eth1
inet6 2a02:1811:e100:e100:a9cc:a9c8:c2bb:f335/64 scope global temporary dynamic
valid_lft 566728sec preferred_lft 47728sec
inet6 2a02:1811:e100:e100:a00:27ff:fe07:b619/64 scope global dynamic
valid_lft 603626sec preferred_lft 85226sec
inet6 fe80::a00:27ff:fe07:b619/64 scope link
valid_lft forever preferred_lft forever

Both GLOBAL ipv6 addresses are type dynamic; they don’t come from a dhcp6 server, but are self generated by a process called Stateless Address Autoconfiguration (SLAAC). Now if we look at the second global dynamic ipv6 address, we notice that it is constructed around the MAC, in the same way as the Link-Local address. If my computer will connect to a website, that ipv6 address can be harvested. However, in today’s ipv4 world, only the public ipv4 address of my router would be seen, and my private addresses would become obscured by NAT.

Does that matter? Well, yes, it could mean less privacy, and for that reason there is a process in my linux machine creating temporary global dynamic ipv6 addresses.

Now there is a problem: if my system creates a new ipv6 address every day, the old sockets would not survive. So we keep old addresses alive for a longer period, lets say a week, but we start new connections with the most recently created ipv6 global temporary dynamic address. We will keep the old sockets alive for a week. In the long run, we will have several auto-created global temporary dynamic addresses.

In my world, this way of working is not good, not good at all. I keep a lot of SSH sessions running permanently. So I can configure a static ipv6 address (in another part of this series), and use that all the time.

How does my system find the right subnet,
and from where does it get an answer?
Did I get a default ipv6 gateway?

To find this out, I started a wireshark sniffing session on my network. I used a capture filterIP6‘. This is what I saw:

No.     Time           Source                     Destination     Protocol Length Info
6 1.540652000 fe80::a00:27ff:fe07:b619   ff02::2                  ICMPv6   70     Router Solicitation from 08:00:27:07:b6:19
7 1.543190000 fe80::5e35:3bff:fe5c:8b35  fe80::a00:27ff:fe07:b619 ICMPv6   206    Router Advertisement from 5c:35:3b:5c:8b:35

Remember that my system autocreated Link-Local addresses regardless whether it was on an ipv6 network. It now uses this address to ask whether an ipv6-router exist on the network. That is the first packet (6).

It sends the solicitation to a multicast address, ff02::2

In ipv6 the designers got rid of annoying broadcasts. They replaced them by task-specific multicast addresses.
An ipv6 multicast address starts with a binary 11111111/8 or ff in hexes.

Link Local Multicasts start with FF02 (www.iana.org)

And an FF02::2 means All Routers Address

So the link local address is used to multicast to all routers and asks for their presence and information.
A unicast answer, packet (7), is sent by all routers (in this case and in most SOHO cases only one) to advertise themselves.

In the body of this packet we find the following intersting parts:

Ethernet II, 
Src: CompalBr_5c:8b:35 (5c:35:3b:5c:8b:35), 
Dst: CadmusCo_07:b6:19 (08:00:27:07:b6:19)
    Type: IPv6 (0x86dd)
Internet Protocol Version 6, 
Src: fe80::5e35:3bff:fe5c:8b35
Dst: fe80::a00:27ff:fe07:b619
    Next header: ICMPv6 (58)
Internet Control Message Protocol v6
    Type: Router Advertisement (134)
    Cur hop limit: 64
        ...0 1... = Prf (Default Router Preference): High (1)
    Router lifetime (s): 1800
    ICMPv6 Option (Prefix information : 2a02:1811:e100:e100::/64)
    ICMPv6 Option (Recursive DNS Server 2a02:1800:100::41:2 2a02:1800:100::41:1)
        Recursive DNS Servers: 2a02:1800:100::41:2 (2a02:1800:100::41:2)
        Recursive DNS Servers: 2a02:1800:100::41:1 (2a02:1800:100::41:1)
    ICMPv6 Option (DNS Search List Option telenet.be)
        Domain Names: telenet.be
    ICMPv6 Option (Source link-layer address : 5c:35:3b:5c:8b:35)

I snipped away most of the jargon. We see a subnet, DNS-servers (2) and a domain name from my ISP (telenet.be), and the MAC address of the router. The ipv6 address of the router sits inside the ipv6 header.

How and Whom can I ping?

Does it all work? Let me do a ping:

bert@lx24:~$ ping6 google.com
PING google.com(ea-in-x64.1e100.net) 56 data bytes
64 bytes from ea-in-x64.1e100.net: icmp_seq=1 ttl=52 time=16.7 ms
64 bytes from ea-in-x64.1e100.net: icmp_seq=2 ttl=52 time=17.9 ms
64 bytes from ea-in-x64.1e100.net: icmp_seq=3 ttl=52 time=17.8 ms
...
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
...
bert@lx24:~$ ping6 -n google.com
PING google.com(2a00:1450:4013:c01::64) 56 data bytes
64 bytes from 2a00:1450:4013:c01::64: icmp_seq=1 ttl=52 time=15.7 ms
64 bytes from 2a00:1450:4013:c01::64: icmp_seq=2 ttl=52 time=16.9 ms
64 bytes from 2a00:1450:4013:c01::64: icmp_seq=3 ttl=52 time=17.9 ms

it’s obvious that it works …
and that I can ping the world; I’ll come back to this in a next post

Finally, let’s have a look at the routing table:

bert@lx24:~$ route -n6
Kernel IPv6 routing table
Destination                    Next Hop                   Flag  Met Ref Use If
2a02:1811:e100:e100::/64       ::                         UAe    256 0   0 eth1
fe80::/64                      ::                         U      256 0   0 eth1
::/0                  fe80::5e35:3bff:fe5c:8b35  UGDAe 1024 0   0 eth1
::/0                           ::                         !n   -1  1   111 lo
::1/128                        ::                         Un   0   1    13 lo
2a02:1811:e100:e100:a00:27ff:fe07:b619/128 ::             Un   0   1     0 lo
2a02:1811:e100:e100:18bf:ef2:ce5e:ae2a/128 ::             Un   0   1    22 lo
fe80::a00:27ff:fe07:b619/128   ::                         Un   0   1     9 lo
ff00::/8                       ::                         U    256 0     0 eth1
::/0                           ::                         !n   -1  1   111 lo

A final remark on the default gateway

Well, the pinging works, once we have a global unicast address. We use a local-link address of the gateway to go outside. This is not necessary, we can also use a static global unicast address for it. The latter looks more familiar, but it doesn’t have to be; after all, your default gateway in ipv4 is usually a private address too.

What’s next:

In part 3 we will be looking at DNS / traceroute / … how do I do “this” in ipv6

References:

IPv6 temporary addresses and privacy extensions

IPv6 Multicast Address Space Registry

Observing Router Advertisements

IPv6: Goodbye to broadcast, say hello to Multicast

Multicast Listener Discovery Version 2 (MLDv2) for IPv6

ICMP Version 6 (ICMPv6) Informational Message Types and Formats

Marking Packets

IPv6-ready kernel

Post Scriptum:

It is difficult to create posts like this in WordPress. All themes generally messed up the lay-out I wanted. Double spacing where single spacing was required, joining two paragraphs where only one was available, separating one paragraph into several parts, etc ….

I started editing in WP, then switched to LibreOffice, next to Google Docs. Google Docs used a lot less lay-out, but still too much for WP. I’m slightly disappointend :-)

ipv6 for home / small business — part 1

about:

In this series I will discuss connecting via ipv6 to the outside world, and back.

In this first post, I will peek at ipv6 in my cable-modem router. We are talking about a decent cable modem from compal: Gateway-CH6643E

docsis_7594

The router itself is about 3 years old, routes coax-cable-internet to LAN and WiFi using NAT, and it is capable of doing this via ipv4 as well as ipv6. The latter has been slowly rolled out by my provider, telenet.be, owned by Liberty Global.

some ipv6 basics

In January 2014 I noticed that my PC showed a “global” IPV6 address:
inet6 addr: 2a02:1811:e100:e100::27ff:fe2d:ba0c/64 Scope:Global

Global ipv6 addresses in 2014 must start with a binary 001 mask /3
This means that in practice, the hex global addresses currently assigned, must start with a 2 (0010) or a 3 (0011).

So any ipv6 address starting with 2 or 3 in the highest position is a global unicast address. IPV6 Global Unicast addresses are routable on the ipv6 internet.

Before I only ‘owned’ an ipv6 link local unicast address:
inet6 addr: fe80::76d4:35ff:fe80:b46c/64 Scope:Link

Link-local unicast addresses start with a binary 11111110 10 mask /10 In practice, the hex form of the address always starts with fe8 (1111 1110 1000),
fe9 (1111 1110 1001), fea (1111 1110 1010) or feb (1111 1110 1011).

The link-local address is most often self generated containing a unique MAC-address or by using a pseudo randomizing algorithm. Link local addresses are not routable on the internet.

Another very important address is ::1 the local loopback address; you’re familiar with it in the ipv4 world as 127.0.0.1

If you’re interested in reading a routing table in ipv6 it is important to know that the default gateway points to ::

in the ipv4 world known as 0.0.0.0

the router

What does my cable router tell me:

LAN-configuration:

LAN-subnet-ipv4: 10.0.1.0/24
LAN-subnet-ipv6: 2a02:1811:e100:e100::/64
LAN-IPv4: 10.0.1.1
LAN-IPv6: 2a02:1811:e100:e100:5e35:3bff:fe5c:8b35

WAN-configuration:

IPv4-adres: 94.225.67.23/19
IPv6-adres: 2a02:181f:1:4142:29fc:39b:2213:df3e

the network ipv4

In ipv4 we see two networks connected to the docsis router:

A private 10.0.1.0/24 with 254 host-ip-adresses and a public address routable on the internet. The 32bit private address is divided into a 24bit net-id and 8 bits for hosts. The docsis will do Network-Address-Translation.

The public address resides into a large ISP metro-net 94.225.64.0-94.225.95.255 with 19 bits reserved for the network and 13 bits for hosts (leaving up to 8000+ addresses in this network).

the network ipv6

There are two networks connecting to the docsis router. Both are global unicast networks.

Basically this means that “our” ipv6 network, on the right side of the docsis router, — 2a02:1811:e100:e100::/64 — is reachable from outside and routable on the internet. This is not a private ip-range, and there is no NAT, only pure routing.

In my case there was no danger for visitors from outside, since the docsis router in default ipv6 settings, functions as a firewall blocking all traffic that has not been originating/initiated from inside. However this might not be the case with your isp and/or with your access-router. It might be a good thing to check this as soon as you discover global unicast ipv6 addresses on your systems.

From a hacker’s point of view the ipv6 world today is a paradise of unprotected machines as well as a desert where these machines are extremely difficult to find.

The network assigned to me has 64bit assigned as network portion: 2a02:1811:e100:e100// . This is a HUGE network, and I can do with it what I want !!! Every hex-number contains four bits. These 16 hex-numbers (2a02:1811:e100:e100) are fixed for my network.

There is another 64 bits space left for me to fill in. While in the unaware state, unaware that my machines had given themselves an ipv6 address, these addresses were created on a temporary base and semi-random.

If a hacker could guess my net-ID, (s)he could then randomly test addresses in that 64 bit space. This is however rather unlikely today:

2 to the power of 64 is 1.800 000 000 000 000 000. I can devide my own network space into 4 billion networks, the size of today’s ipv4 internet.
In most lottery systems around the globe, today, you have a chance of one out of 10 billion to win. The hacker has a chance of 4 out of 2 quintillion to correctly guess an address. It’s still very lonely in the ipv6 internet :-)

If you randomly test 100 ipv4 addresses in today’s internet, I’m sure you get more than 10 responses. If you randomly test 1 000 000 global unicast ipv6 addresses, your response is probably going to be zero.

 

Next Some Hands ON

… –>> Where do I start … that will be the subject of next post.

 

PacketTracer6 on Ubuntu Trusty

packettracer6 in ubuntu14.04 (or linux mint 17) (x86_64)

[ disclaimer: just a blog post, not a how-to :-) ]

when you are inscribed on a cisco course
you can download PT6 “Cisco_Packet_Tracer_6.0.1_for_Linux-Ubuntu_installation.bin
for Ubuntu …

I moved it into an isolated directory before executing, but it was not necessary:

$ mkdir pt-install
$ mv Cisco_Packet_Tracer_6.0.1_for_Linux-Ubuntu_installation.bin pt-install

then chmodded and executed with sudo

$ sudo chmod +x Cisco_Packet_Tracer_6.0.1_for_Linux-Ubuntu_installation.bin
$ sudo ./Cisco_Packet_Tracer_6.0.1_for_Linux-Ubuntu_installation.bin

Self extracting archive…
Welcome to Cisco Packet Tracer 6.0.1 Installation
Read the following End User License Agreement “EULA” carefully. You must accept the terms of this EULA to install and use Cisco Packet Tracer 6.0.1.

Press the Enter key to read the EULA.

Do you accept the terms of this EULA? (Y)es/(N)o

Y

You have accepted the terms to the EULA. Cisco Packet Tracer will now be installed.
Attempting to install package now
Selecting previously unselected package packettracer.
(Reading database … 217630 files and directories currently installed.)
Preparing to unpack PacketTracer-6.0.1.i386.deb …
Unpacking packettracer (6.0.1) …
Setting up packettracer (6.0.1) …
Installed files. Please wait for post-install operations to finish..
/usr/local/PacketTracer6/registerPktsGnome: line 7: gtk-update-icon-cache: command not found
Writing PT6HOME environment variable to /etc/profile
Processing triggers for desktop-file-utils (0.22-1ubuntu1) …
Processing triggers for mime-support (3.54ubuntu1) …
Processing triggers for gnome-icon-theme (3.10.0-0ubuntu2) …

Trying to launch from terminal:

$ cd /usr/local/PacketTracer6/bin
$ ./PacketTracer6

./PacketTracer6: error while loading shared libraries: libQtScriptTools.so.4: cannot open shared object file: No such file or directory

Checking the failing dependencies:

$ ldd ./PacketTracer6 | grep not

libQtScriptTools.so.4 => not found
libQt3Support.so.4 => not found

Installing the first dependency:

$ sudo apt-get install qtscript-tools:i386

Reading package lists… Done
Building dependency tree
Reading state information… Done
The following extra packages will be installed:
libqt4-scripttools:i386
Suggested packages:
libqtscript4-doc:i386
Recommended packages:
libqtscript4-qtbindings:i386

Checking the failing dependencies again:

$ ldd ./PacketTracer6 | grep not

libQt3Support.so.4 => not found

So I tried the same as before … and went to install libqt3support4-perl:i386 (incorrectly identifying the package containing the lib)

but then dependency hell broke loose …

so I did what was suggested by DedunuDhananjaya on
http://www.dedunu.info/2013/12/installing-cisco-packet-tracer-601-on.html

$ sudo dpkg –add-architecture i386

$ sudo apt-get install libnss3-1d:i386 libqt4-qt3support:i386 libssl1.0.0:i386 libqtwebkit4:i386 libqt4-scripttools:i386

Reading package lists… Done
Building dependency tree
Reading state information… Done
libqt4-scripttools:i386 is already the newest version.
libqtwebkit4:i386 is already the newest version.
libssl1.0.0:i386 is already the newest version.
The following NEW packages will be installed:
libnspr4:i386 libnss3:i386 libnss3-1d:i386 libqt4-designer:i386
libqt4-qt3support:i386

Setting up libnspr4:i386 (2:4.10.2-1ubuntu1.1) …
Setting up libnss3:i386 (2:3.15.4-1ubuntu7) …
Setting up libqt4-designer:i386 (4:4.8.5+git192-g085f851+dfsg-2ubuntu4) …
Setting up libqt4-qt3support:i386 (4:4.8.5+git192-g085f851+dfsg-2ubuntu4) …
Setting up libnss3-1d:i386 (2:3.15.4-1ubuntu7) …
Processing triggers for libc-bin (2.19-0ubuntu6) …

Apparently I first misidentified the packet to be installed when using aptitude search for libqt3support4. The packet marked in red might have been the only one necessary.

And yes !!!

finally all dependencies have been met !!!

I made a launcher containing: /usr/local/PacketTracer6/bin/PacketTracer6
and here is the result …

Screenshot

Of course, I should have reverse looked up the library with dpkg -S

$ dpkg -S libQt3Support.so.4
libqt4-qt3support: /usr/lib/i386-linux-gnu/libQt3Support.so.4
libqt4-qt3support: /usr/lib/i386-linux-gnu/libQt3Support.so.4.8.1
libqt4-qt3support: /usr/lib/i386-linux-gnu/libQt3Support.so.4.8

But then, we are not always smart enough to find the easiest road to a destination.

Users, Groups and their permissions, Debian Wheezy 7.2.

Users, Groups and their permissions, Debian Wheezy 7.2.

In this tutorial we’ll talk about users, groups and their permissions on files and directories.
We’ll guide you how to add users and make them members of groups.
At this point we’ve only one default user installed.
Let’s see wich user is active by using whoami commando.
Type whoami + enter.
We see user “anne” is logged into our system.

anne@alfa:~$ whoami
anne
anne@alfa:~$

You can use who commando to see all users on your system.
We didn’t execute that but we used users commando instead of who.
Type users + enter.

anne@alfa:~$ users
anne anne
anne@alfa:~$

Our output displays “anne” twice.
Our Debian Wheezy system handles different kinds of users and groups.
The first “anne” is the user itself (owner) and the second “anne” correspond her primary group membership.
Users can be member of primary and supplementary groups.
This will be discussed later on.
Short description of the characters u.g.o.a. used on our Debian Wheezy systeem.
u = user (owner)
g = group (group which user belongs to)
o = other (everyone who logged local or on a remote machine)
a = All users belonging to u,g and o.

Each file or directory created by the user “anne” becomes her property and she’ll have read, write and execute permission in her /home/anne directory.
The primary group “anne” and the “others” (everyone) have read and execute rights on the folders and subdirectories owned by anne.
Take in account that all users belonging to others can read the contents of the /home/anne directory.
This is in fact a security breach and it must be taken care off.
How to do that will be discussed later on.
Luckily nobody have write permission on /home/anne except “anne” and user “root”.
Let’s take a closer look at our permissions in the home directory of “anne”.
Type ls -l + enter.

anne@alfa:~$ pwd
/home/anne
anne@alfa:~$ ls -l
total 32
drwxr-xr-x 3 anne anne 4096 Nov  4 16:09 Desktop
drwxr-xr-x 3 anne anne 4096 Dec  1 14:51 Documents
drwxr-xr-x 2 anne anne 4096 Nov 16 20:18 Downloads
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Music
drwxr-xr-x 2 anne anne 4096 Dec  7 13:05 Pictures
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Public
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Templates
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Videos
anne@alfa:~$

We’ll explain our output displayed above.
d = directory
l = link (not displayed in this output)
– = file (not displayed in this output)
rwx = read, write, execute permission user anne
r-w = read, execute permission primary group anne
r-w = read, execute permission others (everyone)
3 = number of available links to directory
anne = user (owner)
anne = primary group anne which user anne belongs to
4096 = size of the direcoty in bytes
Nov = month of last modification directory
4 = date of last modification directory
16:09 = time stamp last modification directory
Desktop = name of the directory

Let’s examine our directory root /.
De root directory is the home directory owned by the user root.
The user root has full permission over the whole system even not owned folders and files.
The users which belongs to the primary group ‘root’ and ‘others’ are permitted to read and execute.
This mean everyone can read those directories but they aren’t able to write.
It’s nice to explore those directories who has learning purposes.
Our system is a free examine “place” to explore and having fun.
In a company environment can this affect the security purposes.
We’ll discus this later on.
Typ cd / + enter and than type ls -l + enter.

anne@alfa:~$ cd /
anne@alfa:/$ ls -l
total 88
drwxr-xr-x   2 root root  4096 Oct 17 16:12 bin
drwxr-xr-x   3 root root  4096 Oct 17 16:16 boot
drwxr-xr-x  14 root root  3160 Jan  9 17:59 dev
drwxr-xr-x 133 root root 12288 Jan  9 17:59 etc
drwxr-xr-x   3 root root  4096 Oct 17 16:18 home
lrwxrwxrwx   1 root root    30 Oct 17 15:47 initrd.img -> /boot/initrd.img-3.2.0-4-amd64
drwxr-xr-x  16 root root  4096 Oct 17 16:12 lib
drwxr-xr-x   2 root root  4096 Oct 17 15:46 lib64
drwx——   2 root root 16384 Oct 17 15:45 lost+found
drwxr-xr-x   4 root root  4096 Oct 25 11:57 media
drwxr-xr-x   2 root root  4096 Sep 23 00:31 mnt
drwxr-xr-x   2 root root  4096 Oct 17 15:46 opt
dr-xr-xr-x 135 root root     0 Jan  9 17:59 proc
drwx——   9 root root  4096 Dec 12 17:35 root
drwxr-xr-x  19 root root   840 Jan  9 18:03 run
drwxr-xr-x   2 root root  4096 Oct 17 16:19 sbin
drwxr-xr-x   2 root root  4096 Jun 10  2012 selinux
drwxr-xr-x   2 root root  4096 Oct 17 15:46 srv
drwxr-xr-x  13 root root     0 Jan  9 17:59 sys
drwxrwxrwt   9 root root  4096 Jan  9 19:17 tmp
drwxr-xr-x  10 root root  4096 Oct 17 15:46 usr
drwxr-xr-x  12 root root  4096 Oct 17 16:14 var
lrwxrwxrwx   1 root root    26 Oct 17 15:47 vmlinuz -> boot/vmlinuz-3.2.0-4-amd64
anne@alfa:/$

Let’s make a direcoty “TEST” into / directory.
Be aware you’re logged in as default user $.
Type mkdir TEST + enter.
Your prompt will display “mkdir: cannot create directory `TEST': Permission denied”.
As you already know the user root has ownership of the directory root.
At default the user root is the only one that can change every file and directory into our system.
User anne has no write permission, only read and execute.

We’ll create a second user Eddy and his /home/Eddy directory.
We’ve two commando’s available, useradd and adduser.
Adduser will create the new user at a interactive manner instead useradd.
We’ve chosen the low level utility useradd using the arguments -m and -U.
Short explanation of our arguments we’ll using to create new user Eddy.
-m:
Create the user’s home directory if it does not exist.
The files and directories contained in the skeleton directory (which can be defined with the
-k option) will be copied to the home directory.

-U:
Create a group with the same name as the user, and add the user to this group.
The default behavior (if the -g, -N, and -U options are not specified)
is defined by the USERGROUPS_ENAB variable in /etc/login.defs.

-p:
–password PASSWORD
The encrypted password, as returned by crypt (3).
The default is to disable the password.
Note: This option is not recommended because the password (or encrypted password) will be visible by users
listing the processes.
You should make sure the password respects the system’s password policy.

-p:
This argument will be not used because this will be visible in our terminal history.
The password will be provided using passwd commando instead useradd -p.

Let’s create user Eddy.
First login as root by typing su + enter.
You’ll be asked to fill in your “root” password + enter.
Your prompt shows # sign being root.

anne@alfa:~$ su
Password:
root@alfa:/home/anne#

Type useradd -m -U Eddy + enter.
The new user Eddy and his home directory is added into our system.

root@alfa:/home/anne# useradd -m -U Eddy
root@alfa:/home/anne#

Check Eddy’s /home directoy by using ls command.
Our new user’s home directory has been made successfully.
Type ls -l /home + enter.

root@alfa:/home/anne# ls /home
anne  Eddy
root@alfa:/home/anne#

Restart your computer to take affect modifications.
Our user Eddy has no login password set and would be unable to login the system.
We’ll provide one at Eddy but he must change it at first login.
We’re still logged as user root so we can carry on.
Type passwd Eddy + enter.
You’ll be asked to enter Eddy’s password + enter.
Retype the same password as your first attempt +enter.
At most companies it’s a mandatory task for new user to change their login passwords.
In most cases it’s forbidden to share login passwords even by system administrators.
Users can change their own password using the same command without being root.
If users can’t remember their passwords only sysadmins are able to provide new ones.
Our user Eddy has received his password provided by our system administrator and would be able to use his freshly created account.

root@alfa:~# passwd Eddy
Enter new UNIX password: (sdf123456)
Retype new UNIX password: (sdf123456)
passwd: password updated successfully
root@alfa:~#

Now we’ve two users Eddy and anne installed into our system.
We’ll face a security breach and privacy issues which will affect both users.
Let’s take a look which permissions our users have in their home directories.
Type cd /home + enter.
Check the permissions available on both directories anne and Eddy.
Type sl -l + enter.
We discover that everyone who’s logged into the system can access both user’s home directories and read contents of it.
At company employees it isn’t  a good practice and insecure.

anne@alfa:/$ cd /home
anne@alfa:/home$ ls -l
total 8
drwxr-xr-x 25 anne anne 4096 Jan 10 14:38 anne
drwxr-xr-x 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
anne@alfa:/home$

Let’s take a closer look in /home/anne direcoty.
Type ls -Rl anne + enter.
Her folders, subfolders and files are readable by Eddy and everyone.

anne@alfa:/home$ ls -Rl anne
anne:
total 32
drwxr-xr-x 3 anne anne 4096 Nov  4 16:09 Desktop
drwxr-xr-x 3 anne anne 4096 Dec  1 14:51 Documents
drwxr-xr-x 2 anne anne 4096 Nov 16 20:18 Downloads
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Music
drwxr-xr-x 2 anne anne 4096 Dec  7 13:05 Pictures
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Public
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Templates
drwxr-xr-x 2 anne anne 4096 Oct 17 16:25 Videos

anne/Desktop:
total 4
drwxr-xr-x 3 anne anne 4096 Nov  5 18:43 Gnubizz

anne/Desktop/Gnubizz:
total 8
-rw-r–r– 1 anne anne  450 Nov  5 18:43 GnubizzSite
drwxr-xr-x 4 anne anne 4096 Nov  4 16:09 OpenSourceComputing

anne/Desktop/Gnubizz/OpenSourceComputing:
total 8
drwxr-xr-x 2 anne anne 4096 Nov  5 20:54 Gnubizz1
drwxr-xr-x 2 anne anne 4096 Nov  5 20:55 Gnubizz2

anne/Desktop/Gnubizz/OpenSourceComputing/Gnubizz1:
total 4
-rw-r–r– 1 anne anne 1423 Nov  5 22:25 GnubizzSite

anne/Desktop/Gnubizz/OpenSourceComputing/Gnubizz2:
total 4
-rw-r–r– 1 anne anne 450 Nov  5 20:55 GnubizzSite

anne/Documents:
total 4
drwxr-xr-x 3 anne anne 4096 Jan  9 22:49 GnuBizz

anne/Documents/GnuBizz:
total 68
-rw-r–r– 1 anne anne 16999 Jan  9 22:21 INFO_USERADD
-rw-r–r– 1 anne anne 16999 Jan  9 20:37 INFO_USERADD~
-rw-r–r– 1 anne anne  9460 Jan  9 22:49 Permissions
-rw-r–r– 1 anne anne  9317 Jan  9 22:21 Permissions~
drwxr-xr-x 2 anne anne  4096 Jan  9 18:09 Published

anne/Documents/GnuBizz/Published:
total 188
-rw-r–r– 1 anne anne 31853 Nov  5 23:55 A.odt
-rw-r–r– 1 anne anne 30402 Nov 17 20:29 Application_Locations.odt
-rw-r–r– 1 anne anne 29148 Nov 12 23:55 GbuBizz
-rw-r–r– 1 anne anne 24809 Oct 29 19:22 Gnubizz
-rw-r–r– 1 anne anne 12728 Dec  7 13:38 OpenApplicationInGUIandTerminal.odt
-rw-r–r– 1 anne anne 31003 Nov 16 22:45 Programma_Locaties.odt
-rw-r–r– 1 anne anne 13496 Oct 25 12:40 TerminalExplorationInHomeDirectoryDebianWheezy7.odt

anne/Downloads:
total 0

anne/Music:
total 0

anne/Pictures:
total 0

anne/Public:
total 0

anne/Templates:
total 0

anne/Videos:
total 0
anne@alfa:/home$

Take in account that each user owns his/her home directory.
The user is able to change his/her permission on their own files and directories without being root.
We can grant three permissions available: read, write and execute.
While using chmod commando we’ll use numbers instead using read, write and execute.
The number shown below correspond each permission.
4 = read
2 = write
1 = execute

Let’s say we’ve a folder named Drive which has full permission set for all users.
It’ll look like: drwxrwxrwx 1 anna anne 4096 jan 10 15:56 Drive
We’ll avoid that everyone can access this Drive by changing some permissions.
The followed command would be: chmod 750 Drive + enter.
Now the permissions on Drive would look like: drwxr-x— 1 anna anne 4096 jan 10 15:56 Drive
Thus we’ve to count this numbers to get our permission set like shown below.
read, write and execute = 7
read and execute = 5
read and write = 6
The effective permissions on Drive would be:
750
7 = read, write and execute permission for the owner (user)
5 = read, execute permission for the group which the user belongs to.
0 = No permission set for everyone.

Ok let’s change both user’s permissions as user root.
Loggin as root by typing su + enter.
You’ll be asked to fill in your password + enter.
Your prompt will display # sign.

anne@alfa:~$ su
Password:
root@alfa:/home/anne#

Check existing permissions at both users /home directories.
Type ls -l /home + enter.

root@alfa:/home/anne# ls -l /home
total 8
drwxr-xr-x 25 anne anne 4096 Jan 10 15:56 anne
drwxr-xr-x 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
root@alfa:/home/anne#

As you already know both users are able to access each others files and directories.
We’ll change those permissions that will affect everyone users except root.
They’re no longer allowed anymore to read contents of other users.
Type chmod -R 750 /home/Eddy + enter.
The argument -R will force the permission on the sub-folders as well.

root@alfa:/home/anne# ls -l /home
total 8
drwxr-xr-x 25 anne anne 4096 Jan 10 15:56 anne
drwxr-xr-x 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
root@alfa:/home/anne# chmod 750 /home/Eddy
root@alfa:/home/anne#

Check if the change has took place.
We notice the permission by everyone has changed.
Type ls -l /home + enter.

root@alfa:/home/anne# ls -l /home
total 8
drwxr-xr-x 25 anne anne 4096 Jan 10 15:56 anne
drwxr-xr-x 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
root@alfa:/home/anne# chmod 750 /home/Eddy
root@alfa:/home/anne# ls -l /home
total 8
drwxr-xr-x 25 anne anne 4096 Jan 10 15:56 anne
drwxr-x— 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
root@alfa:/home/anne#

Logout as user root by typing exit + enter.
Your prompt displays $ again.
Now we’re ready to test if our permissions works.
We’re logged in as anne.
Navigate to /home by typing cd /home + enter.
Our working directory is /home that contains the sub-folders anne and Eddy.
Type ls + enter.

anne@alfa:~$ cd /home
anne@alfa:/home$ ls
anne  Eddy
anne@alfa:/home$

Ok we would like to see anne’s subdirectories.
You’ll see all the folders owned by anne.
Type ls anne + enter.

anne@alfa:~$ cd /home
anne@alfa:/home$ ls
anne  Eddy
anne@alfa:/home$ ls anne
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
anne@alfa:/home$

We’ll redo this command to see Eddy’s sub-directories.
Hm, We’ll encounter a issue displayed below.
Our output give us the reason why this task can’t be performed.
ls: cannot open directory Eddy: Permission denied
We’ve no read permission anymore because we belongs to the users “everyone”.
Type ls Eddy + enter.

anne@alfa:~$ cd /home
anne@alfa:/home$ ls
anne  Eddy
anne@alfa:/home$ ls anne
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
anne@alfa:/home$ ls Eddy
ls: cannot open directory Eddy: Permission denied
anne@alfa:/home$

Can we access his home directoy? I don’t think so.
Let’s test it and type cd Eddy + enter.
No success  to access it which protects Eddy’s privacy.
Our output displays the reason why: cd: Eddy: Permission denied

anne@alfa:~$ cd /home
anne@alfa:/home$ ls
anne  Eddy
anne@alfa:/home$ ls anne
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
anne@alfa:/home$ ls Eddy
ls: cannot open directory Eddy: Permission denied
anne@alfa:/home$ cd Eddy
bash: cd: Eddy: Permission denied
anne@alfa:/home$

We’ve shown how to set permissions at user level but this can become complicated when having much users.
In our example we’ve only two users which are easy manageable.
Our users are divided into two different primary groups anne and Eddy.
Type ls -l + enter.

root@alfa:/home# ls -l
total 8
drwxr-x— 25 anne anne 4096 Jan 11 12:03 anne
drwxr-x— 19 Eddy Eddy 4096 Jan  9 22:39 Eddy
root@alfa:/home#

The best practice is to set permissions at group level instead of users.
We’ll create two users Bert and Vivianne by executing useradd.
We will create a new supplementary group _gnubizzers using groupadd.
A directory GNUBIZZ-DRIVE will be created in our / home directory.
Create both users Bert, Vivianne and their /home directories.
Type useradd -m -U Bert + enter.

anne@alfa:~$ su
Password:
root@alfa:/home/anne# useradd -m -U Bert
root@alfa:/home/anne#

Repeat this command creating user Vivianne.
Type useradd -m -U Vivianne + enter.

anne@alfa:~$ su
Password:
root@alfa:/home/anne# useradd -m -U Bert
root@alfa:/home/anne# useradd -m -U Vivianne
root@alfa:/home/anne#

Restart your computer so the system can write down the modifications you’ve just made.
Check if both users exist by ls commando.
Now we see four users anne, Bert, Eddy and Vivianne.
Type ls /home + enter.

root@alfa:/home/anne# ls /home
anne  Bert  Eddy  Vivianne
root@alfa:/home/anne#

Asign users Bert and Vivianne a login password.
Type passwd Bert + enter.
You’ll be asked to fill in Bert’s new password + enter.
Retype this password + enter.
Do the same task by the user Vivianne.

root@alfa:/home/anne# passwd Bert
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@alfa:/home/anne# passwd Vivianne
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@alfa:/home/anne#

Check the newly user’s permissions by typing ls -l + enter.
Other users are able to read contents of both users Bert and Vivianne.
When you don’t like it to happen you’ve to change it.
Type chmod 750 Bert Vivianne + enter.

root@alfa:/home# ls -l
total 16
drwxr-x— 25 anne     anne     4096 Jan 11 21:48 anne
drwxr-xr-x 19 Bert     Bert     4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy     4096 Jan 11 21:30 Eddy
drwxr-xr-x 19 Vivianne Vivianne 4096 Jan 11 21:47 Vivianne
root@alfa:/home# chmod 750 Bert Vivianne
root@alfa:/home# ls -l
total 16
drwxr-x— 25 anne     anne     4096 Jan 11 21:48 anne
drwxr-x— 19 Bert     Bert     4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy     4096 Jan 11 21:30 Eddy
drwxr-x— 19 Vivianne Vivianne 4096 Jan 11 21:47 Vivianne
root@alfa:/home#

Our next task is creating our directory GNUBIZZ-DRIVE using mkdir commando in the /home directory.
Navigate to /home using cd.
Type mkdir GNUBIZZ-DRIVE + enter.
We’ll face a permission issue by “Permission denied” because we were executing our command as default user.
The directory /home is owned by root.
Login as root by typing su + enter.
Typ your password + enter and retype it again + enter.
Now we’ll be able to perform this task.
Type mkdir GNUBIZZ-DRIVE + enter.
Check by ls -l and you’ll see our newly directoy GNUBIZZ-DRIVE and it’s permissions.
As you can see everyone has read and execute permissions at GNUBIZZ-DRIVE owned by root.

anne@alfa:/home$ mkdir GNUBIZZ-DRIVE
mkdir: cannot create directory `GNUBIZZ-DRIVE': Permission denied
anne@alfa:/home$ su
Password:
root@alfa:/home# mkdir GNUBIZZ-DRIVE
root@alfa:/home# ls -l
total 20
drwxr-x— 26 anne     anne     4096 Jan 11 22:19 anne
drwxr-x— 19 Bert     Bert     4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy     4096 Jan 11 21:30 Eddy
drwxr-xr-x  2 root     root     4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne 4096 Jan 11 21:47 Vivianne
root@alfa:/home#

Change permission at GNUBIZZ-DRIVE so others aren’t able to gain access to it.
Type chmod 750 GNUBIZZ-DRIVE + enter.
At this stage user root and group root has still permissions set.
Check this by ls -l + enter.

root@alfa:/home# chmod 750 GNUBIZZ-DRIVE
root@alfa:/home# ls -l
total 20
drwxr-x— 26 anne     anne     4096 Jan 11 22:19 anne
drwxr-x— 19 Bert     Bert     4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy     4096 Jan 11 21:30 Eddy
drwxr-x—  2 root     root     4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne 4096 Jan 11 21:47 Vivianne
root@alfa:/home#

Now we’re ready to go further using groups instead of users.
Our purpose is to make users members of specific groups.
Our system handles two kinds of groups, primary and supplementary.
Each user becomes a member of a primary group when we created them.
Let’s look which group our users belongs to using id commando.
Type id username + enter.
Here we can see our primary groups of our users:
anne’s primary group is “anne”
Eddy’s primary group is “Eddy”
Bert’s primary group is “Bert”
Viviannes’s primary group is “Vivianne”

anne@alfa:~$ id anne
uid=1000(anne) gid=1000(anne) groups=1000(anne),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),106(scanner),111(bluetooth),113(netdev)
anne@alfa:~$ id Eddy
uid=1001(Eddy) gid=1001(Eddy) groups=1001(Eddy)
anne@alfa:~$ id Bert
uid=1002(Bert) gid=1002(Bert) groups=1002(Bert)
anne@alfa:~$ id Vivianne
uid=1003(Vivianne) gid=1003(Vivianne) groups=1003(Vivianne)
anne@alfa:~$

First we’ll create a new group named _gnubizzers.
To perform this you’ll need high privileges being root.
Login as user root by typing su + enter.
Fill in password of root user + enter.
Retype password + enter.
Your prompt will displays # again.
Create the group _gnubizzers using groupadd commando.
Type groupadd _gnubizzers + enter.

anne@alfa:~$ su
Password:
root@alfa:/home/anne# groupadd _gnubizzers
root@alfa:/home/anne#

Our group _gnubizzers is abandon containing no members yet.
We’ll add users Eddy, Bert and Vivianne to _gnubizzers using usermod commando.
Take in account that our users and group already exist so we’ll use some arguments.
A short arguments -a and -G  explanation:
-a = Append existing user to the group
-G = Specify supplementary group which the user will join.
Be aware and use your root user.
We’re still logged in as root so we’ll continue to make our users members of _gnubizzers.
Type usermod -a -G _gnubizzers Eddy + enter.
Check Eddy’s groups membership using id commando.
Type id Eddy + enter.
Eddy’s primary group is “Eddy” and his supplementary group is “_gnubizzers”

root@alfa:/home# usermod -a -G _gnubizzers Eddy
root@alfa:/home# id Eddy
uid=1001(Eddy) gid=1001(Eddy) groups=1001(Eddy),1004(_gnubizzers)
root@alfa:/home#

Repeat this task by the users Bert and Vivianne.
Type usermod -a -G _gnubizzers Bert + enter.
Than type usermod -a -G _gnubizzers Vivianne + enter.
The group _gnubizzers contains three members Eddy, Bert and Vivanne.
Check their membership using id command followed by their username.
Type id Bert + enter.
Redo this command at the user Vivianne.
You we’ll see  _gnubizzers is added as a supplementary group.

root@alfa:/home# usermod -a -G _gnubizzers Bert
root@alfa:/home# usermod -a -G _gnubizzers Vivianne
root@alfa:/home# id Bert
uid=1002(Bert) gid=1002(Bert) groups=1002(Bert),1004(_gnubizzers)
root@alfa:/home# id Vivianne
uid=1003(Vivianne) gid=1003(Vivianne) groups=1003(Vivianne),1004(_gnubizzers)
root@alfa:/home#

At this moment our members of the group _gnubizzers has no permissions on GNUBIZZ-DRIVE.
Let’s check this using ls -l /home + enter.
We see GNUBIZZ-DRIVE is owned by root and group root.
Our purpose is to change the group ownership from root to _gnubizzers.
At this stage displayed below our user root has full permission and the group root has read and execute permissions.

anne@alfa:~$ ls -l /home
total 20
drwxr-x— 25 anne     anne     4096 Jan 14 11:23 anne
drwxr-x— 19 Bert     Bert     4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy     4096 Jan 11 21:30 Eddy
drwxr-x—  2 root     root     4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne 4096 Jan 11 21:47 Vivianne
anne@alfa:~$

Let’s change the group ownership by using chgrp commando.
We’ll insert some arguments like -v and -R.
-v Is used to see the diagnostics what happened .
-R Is used to operate on files and directories recursively.
Type chgrp -v -R _gnubizzers /home/GNUBIZZ-DRIVE + enter.
Our output displays that the group has changed from root to _gnubizzers.

anne@alfa:~$ su
Password:
root@alfa:/home/anne# chgrp -v -R _gnubizzers /home/GNUBIZZ-DRIVE
changed group of `/home/GNUBIZZ-DRIVE’ from root to _gnubizzers
root@alfa:/home/anne#

Check using ls -l verifying the changes.
The directory GNUBIZZ-DRIVE is still owned by user root but the group ownership has changed to _gnubizzers.
The group _gnubizzers are able to read and execute in the directory GNUBIZZ-DRIVE.

root@alfa:/home/anne# ls -l /home
total 20
drwxr-x— 25 anne     anne        4096 Jan 14 11:23 anne
drwxr-x— 19 Bert     Bert        4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy        4096 Jan 11 21:30 Eddy
drwxr-x—  2 root     _gnubizzers 4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne    4096 Jan 11 21:47 Vivianne
root@alfa:/home/anne#

We’ll change the permissions on GNUBIZZ-DRIVE so our members of the  group _gnubizzers will be able to read, write and execute.
Login as root using su.
Type chmod 770 /home/GNUBIZZ-DRIVE + enter.
Verify your changes using ls -l /home + enter.
The user root (owner) and the group _gnubizzers (group owner) has the same permissions on GNUBIZZ-DRIVE.
Be aware that this situation is far from ideal and insecure using such configurations at companies.
Each member is able to write, change, move, store and even delete other member’s directories and files by accident.
How to avoid this will be discussed later on.

root@alfa:/home/anne# ls -l /home
total 20
drwxr-x— 25 anne     anne        4096 Jan 14 11:23 anne
drwxr-x— 19 Bert     Bert        4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy        4096 Jan 11 21:30 Eddy
drwxr-x—  2 root     _gnubizzers 4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne    4096 Jan 11 21:47 Vivianne
root@alfa:/home/anne# chmod 770 /home/GNUBIZZ-DRIVE
root@alfa:/home/anne# ls -l /home
total 20
drwxr-x— 25 anne     anne        4096 Jan 14 11:23 anne
drwxr-x— 19 Bert     Bert        4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy        4096 Jan 11 21:30 Eddy
drwxrwx—  2 root     _gnubizzers 4096 Jan 11 22:28 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne    4096 Jan 11 21:47 Vivianne
root@alfa:/home/anne#

We’ll show you a security breach on GNUBIZZ-DRIVE.
Login as user Eddy in the same terminal you working on.
First become user root before using login commando.
Type login Eddy + enter.
You’ll be asked to fill in Eddy’s password + enter.
You’re now logged in as “Eddy”.
Verify who is logged by using whoami command.
Type whoami + enter.
Eddy will be displayed.
Check Eddy’s working directory by pwd commando.
Type pwd + enter.
Eddy’s working directory would be /home/Eddy.
Navigate to GNUBIZZ-DRIVE by typing cd /home/GNUBIZZ-DRIVE + enter.
Eddy will create a sub-directory “Eddy-gnu”.
Type mkdir Eddy-gnu + enter.
Verify with ls and Eddy will see his new directory Eddy-gnu stored at GNUBIZZ-DRIVE.
Logout by typing exit + enter and you’ll become root user.
Your prompt shows # sign again being root user.

root@alfa:/home/anne# login Eddy
Password:
Last login: Tue Jan 14 12:43:58 CET 2014 on pts/0
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ whoami
Eddy
$ pwd
/home/Eddy
$ cd /home/GNUBIZZ-DRIVE
$ pwd
/home/GNUBIZZ-DRIVE
$ mkdir Eddy-gnu
$ ls
Eddy-gnu
$ exit
root@alfa:/home/anne#

So far nothing happened yet to proof our configuration issue.
Login as user Vivianne.
Verify Vivianne’s working directory by pwd.
Navigate to GNUBIZZ-DRIVE.
Check which directories are stored at GNUBIZZ-DRIVE by ls -l.
Vivianne will see Eddy’s directory Eddy-gnu.
Take in account the whole group _gnubizzers has full rights on GNUBIZZ-DRIVE.
Let’s test our security risk by removing Eddy’s folder.
Type rmdir Eddy-gnu + enter.
Use ls and you’ll see Eddy’s directory Eddy-gnu is gone.
This is not a good practice being able to delete each others folders and files.
Logout by typing exit + enter.
We’re root again and ready to modify it at a better way.

root@alfa:/home/anne# login Vivianne
Password:
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ pwd
/home/Vivianne
$ cd /home/GNUBIZZ-DRIVE
$ ls -l
total 4
drwxr-xr-x 2 Eddy Eddy 4096 Jan 14 12:52 Eddy-gnu
$ rmdir Eddy-gnu
$ ls
$ exit
root@alfa:/home/anne#

Our goal is working more secure for everyone who’s member of the group _gnubizzers.
Let’s change our permission using a sticky bit.
The user root will not be affected by sticky bit and the permission will remain unchanged.
This will prevent the user being able by deleting files and directories accidently by other users which belongs to the same group _gnubizzers.
Set your permission on GNUBIZZ-DRIVE using chmod commando.
Type chmod -v 1770 /home/GNUBIZZ-DRIVE + enter.
Check this by ls -l /home + enter.

root@alfa:/home/anne# chmod -v 1770 /home/GNUBIZZ-DRIVE
mode of `/home/GNUBIZZ-DRIVE’ changed from 0770 (rwxrwx—) to 1770 (rwxrwx–T)
root@alfa:/home/anne# ls -l /home
total 20
drwxr-x— 25 anne     anne        4096 Jan 14 11:23 anne
drwxr-x— 19 Bert     Bert        4096 Jan 11 21:45 Bert
drwxr-x— 19 Eddy     Eddy        4096 Jan 11 21:30 Eddy
drwxrwx–T  2 root     _gnubizzers 4096 Jan 14 12:59 GNUBIZZ-DRIVE
drwxr-x— 19 Vivianne Vivianne    4096 Jan 11 21:47 Vivianne
root@alfa:/home/anne#

Our security breach must be solved so we’ll test it again.
Type the bold text displayed in our example below.
The red text represents our terminal output.
Just follow this small content and explore and discuss your thoughts.
Don’t forget to be root when logging as another user in the same terminal.
Login as user Eddy and create a directory Eddy-gnu at GNUBIZZ-DRIVE.

root@alfa:/home/anne# login Eddy
Password:
Last login: Tue Jan 14 12:44:45 CET 2014 on pts/0
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ pwd
/home/Eddy
$ cd /home/GNUBIZZ-DRIVE
$ pwd
/home/GNUBIZZ-DRIVE
$ mkdir Eddy-gnu
$ ls -l
total 4
drwxr-xr-x 2 Eddy Eddy 4096 Jan 14 13:27 Eddy-gnu
$ exit
root@alfa:/home/anne#

Login as user Bert and Vivianne and create sub-directory correspond by username:
Vivianne will create directory Vivianne-gnu.
Bert will create directory Bert-gnu.
Type the bold text displayed below.
Login as user Bert and perform the task described above.

root@alfa:/home/anne# login Bert
Password:
Last login: Tue Jan 14 13:30:39 CET 2014 on pts/0
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ pwd
/home/Bert
$ cd /home/GNUBIZZ-DRIVE
$ ls
Eddy-gnu
$ mkdir Bert-gnu
$ ls -l
total 8
drwxr-xr-x 2 Bert Bert 4096 Jan 14 13:31 Bert-gnu
drwxr-xr-x 2 Eddy Eddy 4096 Jan 14 13:27 Eddy-gnu
$$ exit
root@alfa:/home/anne#

Login as user Vivianne and create a sub-directory Vivianne-gnu at GNUBIZZ-DRIVE.
Type the bold text and follow our example below.

root@alfa:/home/anne# login Vivianne
Password:
Last login: Tue Jan 14 12:58:36 CET 2014 on pts/0
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ pwd
/home/Vivianne
$ cd /home/GNUBIZZ-DRIVE
$ mkdir Vivianne-gnu
$ ls -l
total 12
drwxr-xr-x 2 Bert     Bert     4096 Jan 14 13:31 Bert-gnu
drwxr-xr-x 2 Eddy     Eddy     4096 Jan 14 13:27 Eddy-gnu
drwxr-xr-x 2 Vivianne Vivianne 4096 Jan 14 13:42 Vivianne-gnu
$ exit
root@alfa:/home/anne#

Let’s see if users can delete files and directories by accident of othter members.
Login as user Eddy again.
Eddy will remove other members their directories stored at GNUBIZZ-DRIVE.
The bold text must be typed. Explore what will happen and enjoy it.
Nobody of the group _gnubizzers will be able to delete each others files and direcoties.
Notice they’re still be able to read each others contents but they can’t create or remove contents at other members.

If you don’t like that group members are able to read your contents you can change it at your own folders and files stored at GNUBIZZ_DRIVE.
A example what a group member can do.
Supposing Eddy don’t like that others are able to read his contents.
At this stage permissions read and execute rights on Eddy’s-gnu owned by Eddy are granted  for everyone.
drwxr-xr-x 2 Eddy     Eddy     4096 Jan 14 13:27 Eddy-gnu
Eddy can change this by executing chmod 750 Eddy-gnu to avoid reading permissions by others.
Now his folder permission would like this:
drwxr-x— Eddy     Eddy     4096 Jan 14 13:27 Eddy-gnu
The members of the group _gnubizzers aren’t able anymore to read Eddy’s folders and files contents.
Setting permissions can become very complicated and must be well documented by system administrators.

root@alfa:/home/anne# login Eddy
Password:
Last login: Tue Jan 14 13:27:13 CET 2014 on pts/0
Linux alfa 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
$ pwd
/home/Eddy
$ cd /home/GNUBIZZ-DRIVE
$ ls -l
total 12
drwxr-xr-x 2 Bert     Bert     4096 Jan 14 13:31 Bert-gnu
drwxr-xr-x 2 Eddy     Eddy     4096 Jan 14 13:27 Eddy-gnu
drwxr-xr-x 2 Vivianne Vivianne 4096 Jan 14 13:42 Vivianne-gnu
$ rmdir Bert-gnu
rmdir: failed to remove `Bert-gnu': Operation not permitted
$ rmdir Vivianne-gnu
rmdir: failed to remove `Vivianne-gnu': Operation not permitted
$ exit
root@alfa:/home/anne# 

A permission overview configured in our example.
Our system has four users anne, Eddy, Bert and Vivianne.
Membership _gnubizzers:
Eddy, Bert and Vivianne
Non membership of _gnubizzers:
anne and root
The permissions set at users home direcories:
Read, write and execute by the owner (user itself).
Read and execute permission granted at primary group which user belongs to.
No rights granted for everyone.
Permission set at GNUBIZZ-DRIVE shared by the group _gnubizzers:
Read, write and execute rights granted user root.
Read, write and execute rights granted to _gnubizzers members.
Sticky bit set preventing by removing contents of other members.
No rights granted for everyone

So that’s it and we hope you’ve enjoyed it.
Feel free to share your thoughts so we can get things going better.
Don’t hesitate to leave a comment.
We’ll back soon to giude you through this nice system Debian Wheezy 7.2. ;-)

Written by Anne-Marie.

Follow

Get every new post delivered to your Inbox.