1. Chapter 8 File System Security

2. File Protection Schemes Password-Based Protection Encryption-Based Protection Protection-Based on Access Permission

3. File Protection Schemes Password-Based Protection  Both the Login name and password are required for a user to enter a UNIX system  All login names can be found in the /etc/passwd file.  A user’s password is given to that user ONLY.  Change user’s password frequently.  passwd command (for local account)  yppasswd or nispasswd command for network’s computer systems.

4. File Protection Schemes Password-Based Protection  Discovering a user’s password: 1) You, as the owner of an account, inform others of your password 2) a password can be guessed by another user 3) a user’s password can be extracted by “brute force”

5. Figure 8.1 The process of encryption and decryption File Protection Schemes Encryption-Based Protection  Whole Disk Encryption  File-level Encryption

6. File Protection Schemes Protection-Based on Access Permission As file owner, you can attach certain access rights to your files that dictate who can and cannot access them for various types of file operations. /etc/passwd /etc/group

7. File Access Rights Types of Users: – Owner – Group – All/Other Types of Permissions: – Read – Write – Execute Types of Operations Allows on Files – Directories – Other files

8. Table 8.1 Summary of File Permissions in LINUX Read permission Write permission Execute permission

9. Directory Permissions read = list files in the directory write = add new files to the directory execute = access files in the directory

10. Table 8.2 Permission Values

11. Determining and Changing File Access Privileges Determining File Access Privileges –ls –l, ls –ld

12. Changing the Access Rights Purpose – to set/change permissions in files chmod [options] octal-mode filelist chmod [options] symbolic-mode filelist Options -Rrecursively process subdirectories

13. Determining and Changing File Access Privileges (Contd)

14. Examples of chmod Command

15. Determining and Changing File Access Privileges Changing File Access Privileges – chmod [options] octal-mode file-list – chmod [options] symbolic-mode file-list

16. Access Privileges for Directories

17. Default File Access Rights umask is a bitmap which tells which permissions to be turned off when a new files is created. 022 = 000 010 010 (deny write for g+o) rwx r-x r-x (new files permissions) umask (with no parameters returns the current mask value) umask newmask (sets new mask value.) umask command usually used in a startup file

18. Default File Access Rights The default access privileges: – Executable files & directories : 777 – Text files: 666 file access permission = 777 – mask A commonly used mask value is 022. Umask 022 777 - 022 = 755 for executable files & directories 666 - 022 = 644 for text files

19. Figure 8.2 Position of file type and access privilege bits for LINUX files (as seen by “ls –l” command)

20. Figure 8.3 Position of access privilege bits for LINUX files as specified in the chmod command

21. SUID Bit A special permission bit that allows executable files to run using the privileges of the owner of the files rather than the user of the file Can be set using commands: chmod u+s filelist chmod 4xxx filelist Shows up in ls - l in place of the user x bit as an s if the file is executable - (rwsrwxrwx) Very dangerous to use

22. SUID Bit Find both set user id and set group id programs. $ find / -type f –perm +6000 –exec ls –l {}\; > suid_sgid.list cat suid_sgid.list (more or less this file) ls –l /usr/bin/* | grep ‘rws’

23. SGID Bit A special permission bit that allows executable files to run using the privileges of the owner’s group rather than the user of the file Set using the commands chmod g+s filelist chmod 2xxx filelist

24. Sticky Bit A special bit that can be used as follows: For a file: it directs the operating system to keep the program in memory if possible after it finishes execution (Early versions of UNIX) For a directory: it sets it up such that only the owner of the directory can delete (or rename) files from the directory, even if other users have write privilege (tmp) Can be set using the chmod command using the options: chmod +t filelist Shows up in “ls –l” as a t - (rwxrwxrwt)