And yes, the very best way for us to learn this is to go and get our hands dirty,
do some actual work, some Linux administration ourselves.
And this is what we're going to encourage you to do is follow with
me through in this demonstration where we're going to look out
working with our ACLs on our command line.
Come on, let's go find that command line.
So we need to start off by creating ourselves a shared directory.
So we can do this.
We want to create it in the root of our file system,
so I'm going to use sudo and mkdir.
We can set the mode, so ‑m, but we're going to set it to 1700,
and we're going to create the directory private.
Now when setting it to 1700, what we're actually doing is setting the sticky bit,
and we're making sure the directory is private just to the user at the moment.
So you might think then that the sticky bit is irrelevant,
but it can still be used when we have our access control list.
Having set our standard file mode,
we can go through and use ls ‑ld to list those permissions.
And we can see then that we've got read,
write, and execute for our user, and we've got T in our others block.
It's uppercase because execute is not set for our users.
We can prove that the permissions are working as
desired by using the cd command.
So yeah, our security is working exactly the way that we wanted.
We are not allowed, only the root user can get into this directory.
Now I'm going to go through now and start configuring the access control list.
As I run through, I'm going to do a sudo and then setfacl and ‑m for modify.
Now I'm going to begin by setting the default ACL,
and this way I can prove that the default ACL is there to be applied to
new content and does not give access to the directory.
So as I then go through, I can add in the user and we can say then,
in my case, I want to add in my user account,
so I'm adding in the account vagrant, and I can give read,
write, and execute.
It will assign execute to directories, but it won't assign execute to files.
And we can then go through and put in our private.
So that is now set,
but I just want to prove to you that I can still
not access the private directory.
The default access control list is not for the directory itself,
but content created in the directory.
So very often, the two go hand in hand.
When we go through an add in the default ACL, and then we can add in a very
similar ACL where we go through then and add in the user,
but without the d;.
So this is no longer the default.
We're adding the vagrant user to the access control
list of the private directory.
We can still see the permissions that were listed before,
but if I go back and list this again where we go through
and take a look at our private directory,
we can see that a couple of things have changed.
We can see the + symbol is showing.
And that does not mean that SELinux is no longer set,
but it means that an access control list is set.
But also look at the group permissions.
The group permissions have changed to read,
write, and execute,
allowing then permissions to flow through the group
into the access control list.
So generally,
we want to make sure that the group owner is a
private group as it is in this case.
So we're not giving additional permissions to the group owner of the directory.
Now, of course,
we can view just from the + symbol that there is an access control list,
but we're able to go through and use, as we've seen,
our getfacl command on our private directory.
When we go through and take a look at this,
we're able then to see the access control list.
And it shows me the user that we added in, vagrant,
as well as the default access control list.
So all of this is kind of working the way that we want.
If we only wanted to see the default, then we can use an option with getfacl ‑d.
When we go through and take a look at this now,
we can start seeing that we just have the default settings in place.
So this, again, is starting to look very good for me,
but we want to look at some more options that we can use
when we're setting our permissions.
Now,
one of the things that we should discover straight away is
that we don't need to just set one user,
we can have multiple users and multiple groups.
So if I go back into my sudo and setfacl,
I won't worry about the default for the moment.
Just for time, I'm just going to go through and just add in a user.
We can have the user being added to have access to our directory,
and I'm going to use the apache user because I know I have an apache user.
And we can give them, well, let's just have read and execute.
If we want a group to go in instead of this, we can then use group.
We've got an apache group as well,
so I'm just going to leave the apache group in place.
If we want a separate group, then again,
there's no reason why we shan't have multiple groups.
So let's add the wheel group in.
So as we go through then, we can add our multiple users and multiple groups.
And we know that we can use getfacl,
and we can start displaying this information.
So as we then go through and look at our private directory,
we can see there that we've got the user apache,
the user vagrant, the group wheel, and the group apache.
But maybe we feel that we were a little
enthusiastic in adding that extra user in.
We can remove entries as well.
So if I go through instead of using ‑m to modify, but ‑x removes an ACL entry.
We don't need the permissions; we only need the object type,
user and then the name, apache in this case.
With that done and dusted, I'm going to hit my big Enter key,
go back and review the access control list, and we've removed just that entry.
If we are now happy with our access control list,
why don't we go through and redirect the output and create a backup. And we
can then send this through to our /tmp/ and I'm just going to call it acl.
That will do. Now it's a very good job that we created that back up because
some idiot is going to come along now and actually remove the complete ACL. ‑B
deletes the complete ACL, and we just need to go through and remove it from
our private directory.
If I now go through and do a ls ‑ld on our private directory,
we can see the permissions then go back to 1700 where we
don't have an access control list.
When I go through and take a look inside of my backup file,
I can just use Esc and dot to cycle through my arguments.
So it becomes a quick way I can get back to the
tmp/acl When we notice the file name, there's no full path; it's a relative path.
So that's really important.
If we want to restore,
we then go to the root directory, in our case, so we can then
address the file that's called private.
We can then do our sudo setfacl ‑‑restore and then
have our file name, so, =/tmp/acl.
So we're now reading that file. That goes through looks for our
private directory, and thankfully, it will go through and set
everything back the way that it should be. When I go through and take
a look inside of my private directory now, we've got both the default
ACL and our ACL on the directory.
Now if you're working through with me,
you're going to be a long way to achieving your goals
now of knowing how to manage Linux.
But let's make sure we can summarize some of what we've looked at by moving back to our slides.