Jozef Goetz, expanded by Jozef Goetz, 2008 Credits: Parts of the slides are based on slides created by UNIX textbook authors, Syed M. Sarwar, Robert Koretsky, Syed A. Sarwar, 2005 Addison Wesley Copyright © 2005 Pearson Addison- Wesley. All rights reserved.

Jozef Goetz, Objectives You may ignore last slides 19 – 22 To show 3 protection and security mechanisms that UNIX provides To describe the types of users of a UNIX file To discuss the basic operations that can be performed on a UNIX file To explain the concept of file access permissions/ privileges in UNIX To discuss how a user can determine access privileges for a file To describe how a user can set and change permissions for a file To cover the commands and primitives ?, ~, *, chmod, groups, ls – l, ls – ld, umask

Jozef Goetz, Password-based Protection All login names are public knowledge and can be found in the /etc/passwd file. passwd –a contains info for users, each line (7 fields) is as follows: login_name:password:user_ID:user_info:home_directory:login_shell ftp :x :14 :FTP User:/var/ftp :/sbin/nologin

Jozef Goetz, Password-based Protection Change password using: passwd, Some systems: yppasswd, nispasswd 3 ways of discovering a user’s password: 1) You, as the owner of an account, inform others of your password 2) a password can be guessed by another user 3) a user’s password can be extracted by “brute force”

Jozef Goetz, Encryption-based Protection for files

Jozef Goetz, Protection based on Access Permission Types of users Display all preconfigured user groups in the format: gr name, info about group, gr. ID,members of the group user (owner) - to get: whoami group others a user with multiple groups Special user with access to all files and dirs is the superuser login name is root user ID = 0 A user belongs to one group or many: default group membership of a user is specified /etc/passwd cs253u]$ groups cs253u

Jozef Goetz, Groups and Users cmds cs253u]$ whatis groups groups (1) - print the groups a user is in cs253u]$ groups cs253u -bash-2.05b$ groups cs253u15 cs253u15 : cs253u cs253u]$ whatis users users (1) - print the user names of users currently logged in to the current host cs253u]$ users cs253u cs253u15 cs351b17 gchang

Jozef Goetz, Protection based on Access Permission Types of Access Permissions read write (create, remove, modify) execute Access Permissions for Directories execute is permission for searching directory (e.g. by using ls –l) but not for read or write

Jozef Goetz, Protection based on Access Permission

Jozef Goetz, Determining and Changing File Access Privileges Determining File Access Privileges ls –l, ls –ld -d directory list directory entries instead of contents -l use a long listing format

Jozef Goetz, Determining File Access Privileges ls –l, ls –ld execute Determining and Changing File Access Privileges

Jozef Goetz, chmod [options] octal-mode file-list chmod [options] symbolic-mode file-list chmod changes the permissions of each given file according to mode, which can be either a symbolic representation of changes to make, or an octal number representing the bit pattern for the new permissions. Determining and Changing File Access Privileges

Jozef Goetz, chmod [options] octal-mode file-list chmod [options] symbolic-mode file-list Determining and Changing File Access Privileges //start with letter l through t

Jozef Goetz, Examples of chmod Command execute

Jozef Goetz, Determining and Changing File Access Privileges -R Recursive change files and directories

Jozef Goetz, Access Privileges for Directories list the dir contents needs r+x permissions create a file on a dir needs w+x permissions

Jozef Goetz, umask mask When a new file or directory is created, UNIX sets its access privileges based on the argument of the umask command. Current Value of the mask: $ umask 022 The default access permission value on executable file or directory is computed by: file access permission = 777 – mask The default access permission value on text files is computed by: file access permission = 666 – mask A commonly default used mask value is 022 so access permission = 777 – 022 = 755 for.exe files and dirs access permission = 666 – 022 = 644 for text files Default file access privileges

Jozef Goetz, Give the answer about permissions if mask = 077 which is preferable by me. The umask command is normally placed in the system startup file ~/.profile (Sytem V UNIX) or the ~/.login file (in BSD UNIX) so it executes every time you log on to the system Default file access privileges

Jozef Goetz, Special Access Bits

Jozef Goetz, Special Protection Access Bits The Set-User-ID (SUID) Bit If this bit is set for a file containing an executable program for a command, the command takes on the privileges of the owner of the file when it executes. If a file is owned by ‘root’ and has its SUID bit set, it runs with superuser privileges even the file itself doesn’t have those privileges Since the cat command is root owned, a ordinary user runs the command with root privileges! This means that a user can display and/or copy anyone’s files on this system! chmod 4xxx file-list or chmod u+s file-list cs253u]$ chmod 4700 my cs253u]$ ls -l my -rws cs253u cs253u 24 Feb 23 00:50 my cs253u]$ chmod u-s my cs253u]$ ls -l my -rwx cs253u cs253u 24 Feb 23 00:50 my

Jozef Goetz, Special Protection Access Bits The Set-Group-ID (SGID) Bit Causes the access permission of the process to take the group identity of the group to which the owner of the file belongs. chmod 2xxx file-list or chmod g+s file-list cs253u]$ ls -l my -rwx cs253u cs253u 24 Feb 23 00:50 my cs253u]$ chmod 2700 my cs253u]$ ls -l my -rwx--S--- 1 cs253u cs253u 24 Feb 23 00:50 my cs253u]$ chmod g-s my cs253u]$ ls -l my -rwx cs253u cs253u 24 Feb 23 00:50 my

Jozef Goetz, Special Protection Access Bits The Sticky Bit Goal: to keep file(s) in memory or the swap area Can be set for a directory to ensure that an unprivileged user cannot remove, move to the disk or rename files of other users in that directory. It can be set for directories. chmod 1xxx file-list or chmod +t file-list cs253u]$ ls -ld me drwx cs253u cs253u 19 Feb 22 21:55 me cs253u]$ chmod +t me cs253u]$ ls -ld me drwx-----T 2 cs253u cs253u 19 Feb 22 21:55 me cs253u]$ chmod 700 me cs253u]$ ls -ld me drwx cs253u cs253u 19 Feb 22 21:55 me