User & Group Management: Roles, Permissions & Linux Commands

Core Concepts

1. User Accounts: Identity and Access

Every system resource (files, processes, networks) must be tied to an identity. In Linux/Unix, this is the user account, which:

• Authenticates the user (via password or SSH keys).
• Tracks resource usage (CPU, memory, disk quotas).
• Enforces least-privilege access (users get only the permissions they need).

stateDiagram-v2
    [*] --> User:Logs in via SSH
    User:Logs in via SSH --> Auth:Verifies Public Key
    Auth:Verifies Public Key --> Session:Creates Shell
    Session:Creates Shell --> Process:Runs 'esewa-transfer'
    Process:Runs 'esewa-transfer' --> [*]
    Process:Runs 'esewa-transfer' --> Log:Writes to /var/log/esewa
    Log:Writes to /var/log/esewa --> [*]

Real-world tie-in:

• eSewa: When you log in to pay bills, eSewa’s backend checks your user account (stored in a database) to verify you’re authorized to transfer money from your linked bank account. The system uses role-based access control (RBAC): a "customer" role can only view/transfer their own funds, while an "admin" can modify any account.

2. Groups: Organizing Permissions

Groups let you assign permissions to multiple users at once. For example:

• Developers in a team all need read/write access to /var/www/project/.
• Finance staff in a bank need access to ledger files but not customer data.

Key commands:

Worked Example: At Ncell, customer support agents are added to the support_team group. This group has read-only access to call logs but write access to ticket databases. The command to add an agent named ram to this group:

sudo usermod -aG support_team ram

3. File Permissions: RWX Model

Linux uses a 3-digit octal notation (e.g., 755) to represent permissions for:

• Owner (user): Read (4), Write (2), Execute (1).
• Group: Same as owner.
• Others: Public access.

Octal to Symbolic Conversion:

Worked Example: A Daraz order queue script (/var/www/daraz/process_orders.sh) must:

• Be executable by the orders group (to run the script).
• Be readable by the audit group (to log orders).
• Be inaccessible to others. Solution: chmod 750 /var/www/daraz/process_orders.sh.

4. Ownership and ACLs

• Ownership: Files/folders have an owner (user) and group. Change with:

  chown user:group file   # e.g., chown alice:developers report.txt
  

• Advanced Permissions (ACLs): Fine-grained control beyond RWX. Example:

  setfacl -m u:bob:rwx /secret/project   # Grants Bob RWX even if he’s not in the group.
  

Real-world tie-in:

• NEPSE (Nepal Stock Exchange): Shareholder records are stored in files owned by the compliance group. Only the auditor user (outside this group) needs read-only access during inspections. ACLs are used to grant this without adding the auditor to the group:

  setfacl -m u:auditor:r /data/shareholders/2023.csv
  

5. Special Permissions: SUID, SGID, Sticky Bit

Worked Example: In Khalti’s backend, the /usr/bin/transfer script (used to move money between accounts) must run with the bank’s admin privileges, not the customer’s. This is achieved with SUID:

chmod 4755 /usr/bin/transfer   # SUID bit set (4).

6. User Management Commands

Worked Example: At NTC (Nepal Telecom), a new technician sita is hired. The admin runs:

sudo useradd -m -G tech_support sita
sudo passwd sita

This creates a home directory (/home/sita) and adds her to the tech_support group.

7. Shadow Passwords and /etc/ Files

• /etc/passwd: Stores user info (UID, home dir, shell) in plaintext.

  alice:x:1001:1001:Alice Smith:/home/alice:/bin/bash
  

• /etc/shadow: Stores encrypted passwords and account expiry details (accessible only by root).

  alice:$6$rounds=5000$hashedpassword...:19043:0:99999:7:::
  

• /etc/group: Lists groups and their members.

  developers:x:1002:alice,bob,carol
  

In the Real World

1. eSewa:
   • Idea Used: Role-Based Access Control (RBAC).
   • How: When you log in, eSewa’s backend checks your user role (e.g., "customer" or "merchant"). A customer can only view/transfer their money, while a merchant can only access their shop’s transactions. The system uses Linux groups internally to enforce these rules on database files (e.g., /var/lib/esewa/transactions/ is owned by the merchants group).

2. Ncell Customer Support:

   • Idea Used: Group Permissions + ACLs.
   • How: Support agents are added to the support_team group, which has read/write access to call logs (/var/log/ncell/calls/). However, the audit group needs read-only access to these logs for compliance. Instead of adding the audit team to support_team, Ncell uses ACLs:

     setfacl -m g:audit:r-x /var/log/ncell/calls/
     

3. Pathao Driver App:

   • Idea Used: SUID for Privileged Operations.
   • How: When a driver updates their vehicle details in the app, the backend runs a script (/usr/bin/update_driver_vehicle) that must access the database as the pathao_admin user (not the driver). The script has SUID set:

     chmod 4755 /usr/bin/update_driver_vehicle
     

     This ensures the script runs with admin privileges while the driver’s app interacts with it normally.

Common Pitfalls and Best Practices

❌ Avoid These Mistakes

• Over-permissive folders: Setting 777 (world-writable) on /etc/ or /home/.
• Orphaned users: Deleting users without removing their files (userdel -r).
• Hardcoded passwords: Storing passwords in scripts (use sudo or SSH keys instead).

✅ Follow These Rules

• Least privilege: Give users only the permissions they need (e.g., 644 for config files).
• Regular audits: Use sudo grep "777" / -R to find over-permissive files.
• Use visudo: Always edit /etc/sudoers with visudo to avoid syntax errors.

Exam Tip

This unit is heavily tested in TU exams with:

1. Command-based questions (e.g., "Write the command to give the finance group read access to /var/accounts/").
   • Focus on: chmod, chown, setfacl, usermod, useradd.
2. Scenario-based questions (e.g., "A bank’s loan processing script must run as the admin user. How would you configure this?").
   • Focus on: SUID, SGID, sticky bit, and real-world examples (like Ncell or eSewa).
3. Permission calculations (e.g., "What does chmod 640 mean in symbolic form?").
   • Focus on: Octal to symbolic conversion and RWX for user/group/others.
4. Diagram questions (e.g., "Draw the permission bits for a file with rwxr-x---").
   • Focus on: Visualizing permissions in tables or octal notation.

Pro Tip:

• Memorize the 3 key commands: chmod, chown, and setfacl.
• Practice worked examples with Nepali companies (e.g., Daraz order queues, NEPSE shareholder files).
• For scenario questions, always ask:
  • Who needs access? (User/Group/Others)
  • What level of access? (Read/Write/Execute)
  • Is SUID/SGID needed? (For privileged operations)