Lab: Accounts, team folder, sudo and ACLs

What you will learn in this TP

• Manage accounts and groups
• Apply permissions, SGID and ACLs
• Delegate with sudo

Introduction #

What you will learn in this section

• Manage accounts and groups
• Apply permissions, SGID and ACLs
• Delegate with sudo

Context. A development team is joining the server. Each member needs an account, a shared project folder and the ability to restart nginx without being root, and an auditor must be able to read without modifying.

Prerequisites: a disposable Ubuntu 24.04 virtual machine (Multipass, Vagrant or cloud) with a sudo account  ·  Estimated time: 45 min

A working team with least-privilege rights.

Hands-on #

Guided steps, with their solution.

1. 1. Create groups and accounts

   Why? A group carries shared rights; never grant rights user by user.

   Create the devs group, users alice and bob (members of devs), auditor carol and the shell-less service account app.

2. 2. Create the team folder

   Why? The SGID bit inherits the devs group: without it, each file would take its author's personal group.

   Create /srv/projet owned by group devs, mode 2770. Create a file as alice and check that bob can modify it.

3. 3. Protect a sensitive file

   Why? A secret must only be readable by the account that uses it.

   Create /srv/app/app.env owned by app with mode 600, and check alice cannot read it.

4. 4. Grant read access with ACLs

   Why? ACLs add a right for one person without adding them to the group or opening to everyone.

   Give carol read access to /srv/projet and future files (default ACL). Check she can read but not write.

5. 5. Delegate with sudo

   Why? Developers must restart nginx and read its logs, not get a root shell.

   Install nginx, then create /etc/sudoers.d/devs allowing the devs group to restart nginx and read its logs. Validate the syntax and check alice's rights.

6. 6. Account policy and audit

   Why? Unused accounts or unknown SUID binaries are entry points.

   Enforce 90-day password expiry for alice, lock bob, list UID 0 accounts and SUID binaries.

Difficulty level : ●●○○○ (2/5)