DEV Community

Janak Shrestha
Janak Shrestha

Posted on

File Permission Correction

#linux

After conducting a security audit within the Stratos DC, the Nautilus security team discovered misconfigured permissions on critical files. To address this, corrective actions are being taken by the production support team. Specifically, the file named /etc/hosts on Nautilus App 3 server requires adjustments to its Access Control Lists (ACLs) as follows:

  1. The file's user owner and group owner should be set to root.

  2. Others should possess read only permissions on the file.

  3. User john must not have any permissions on the file.

  4. User eric should be granted read only permission on the file.

Solution

Step 1: Connect to App Server 3 (stapp03) 

ssh banner@stapp03
# Password: BigGr33n
Enter fullscreen mode Exit fullscreen mode

Step 2: Switch to root or use sudo 

sudo su -
# Password: BigGr33n
Enter fullscreen mode Exit fullscreen mode

Step 3: Set owner and group to root 

chown root:root /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Step 4: Set others to have read-only permissions 

chmod o=r /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Command breakdown:

  • o=r: Set others (not owner, not group) to read-only
  • This removes write and execute for others

Alternative:

chmod 644 /etc/hosts
# 644 = rw-r--r-- (owner: rw, group: r, others: r)
Enter fullscreen mode Exit fullscreen mode

Step 5: Remove all permissions for user john 

setfacl -m u:john:--- /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Command breakdown:

  • setfacl: Set file ACLs
  • -m: Modify ACL
  • u:john:---: User john with no permissions (read, write, execute all denied)

Step 6: Grant read-only permission to user eric 

setfacl -m u:eric:r-- /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Command breakdown:

  • setfacl -m: Modify ACL
  • u:eric:r--: User eric with read-only permissions

Step 7: Verify all permissions and ACLs 

# Check basic permissions
ls -la /etc/hosts

# Check ACLs
getfacl /etc/hosts

# Verify specific user permissions
getfacl /etc/hosts | grep -E "john|eric"
Enter fullscreen mode Exit fullscreen mode

Complete One-Line Commands

From jump host with password: 

echo 'BigGr33n' | ssh banner@stapp03 "sudo -S bash -c 'chown root:root /etc/hosts && chmod o=r /etc/hosts && setfacl -m u:john:--- /etc/hosts && setfacl -m u:eric:r-- /etc/hosts && getfacl /etc/hosts'"
Enter fullscreen mode Exit fullscreen mode

From jump host using heredoc: 

ssh banner@stapp03 << 'EOF'
echo 'BigGr33n' | sudo -S bash -c '
echo "Setting owner and group to root..."
chown root:root /etc/hosts

echo "Setting others to read-only..."
chmod o=r /etc/hosts

echo "Removing all permissions for user john..."
setfacl -m u:john:--- /etc/hosts

echo "Granting read-only permission to user eric..."
setfacl -m u:eric:r-- /etc/hosts

echo ""
echo "Verification:"
ls -la /etc/hosts
echo ""
echo "ACL Entries:"
getfacl /etc/hosts
'
EOF
Enter fullscreen mode Exit fullscreen mode

Step-by-Step Interactive Commands 

# Connect to stapp03
ssh banner@stapp03
# Enter password: BigGr33n

# Become root
sudo su -
# Enter password: BigGr33n

# Step 1: Set owner and group to root
chown root:root /etc/hosts

# Step 2: Set others to read-only
chmod o=r /etc/hosts

# Step 3: Remove all permissions for user john
setfacl -m u:john:--- /etc/hosts

# Step 4: Grant read-only permission to user eric
setfacl -m u:eric:r-- /etc/hosts

# Step 5: Verify all settings
ls -la /etc/hosts
# Expected: -rw-r--r-- 1 root root ... /etc/hosts

getfacl /etc/hosts

# Expected output should show:
# # file: /etc/hosts
# # owner: root
# # group: root
# user::rw-
# user:john:---
# user:eric:r--
# group::r--
# mask::r--
# other::r--

# Exit back
exit
exit
Enter fullscreen mode Exit fullscreen mode

Verification Commands

Run these to confirm everything is correct:

# 1. Check basic permissions
ls -la /etc/hosts
# Should show: -rw-r--r-- 1 root root

# 2. Check owner and group
stat -c "%U %G" /etc/hosts
# Should output: root root

# 3. Check others permission
stat -c "%a" /etc/hosts | cut -c3
# The last digit should be 4 (read-only)

# 4. Verify ACLs
getfacl /etc/hosts

# 5. Check specific user john (should have no permissions)
sudo -u john cat /etc/hosts
# Should show: cat: /etc/hosts: Permission denied

# 6. Check specific user eric (should have read permission)
sudo -u eric cat /etc/hosts
# Should show the file content

# 7. Test write access for others
sudo -u nobody echo "test" >> /etc/hosts
# Should show: /etc/hosts: Permission denied

# 8. Verify ACL mask
getfacl /etc/hosts | grep mask
# Should show: mask::r--
Enter fullscreen mode Exit fullscreen mode

Expected Output 

[root@stapp03 ~]# chown root:root /etc/hosts
[root@stapp03 ~]# chmod o=r /etc/hosts
[root@stapp03 ~]# setfacl -m u:john:--- /etc/hosts
[root@stapp03 ~]# setfacl -m u:eric:r-- /etc/hosts

[root@stapp03 ~]# ls -la /etc/hosts
-rw-r--r-- 1 root root 234 Jul 10 10:00 /etc/hosts

[root@stapp03 ~]# getfacl /etc/hosts
getfacl: Removing leading '/' from absolute path names
# file: etc/hosts
# owner: root
# group: root
user::rw-
user:john:---
user:eric:r--
group::r--
mask::r--
other::r--

[root@stapp03 ~]# sudo -u john cat /etc/hosts
cat: /etc/hosts: Permission denied

[root@stapp03 ~]# sudo -u eric cat /etc/hosts
127.0.0.1   localhost localhost.localdomain
::1         localhost localhost.localdomain
... (content continues)
Enter fullscreen mode Exit fullscreen mode

Understanding ACLs

ACL Permission Symbols

Symbol Permission Description
--- No permissions User has no read, write, or execute
r-- Read only User can read the file
rw- Read and Write User can read and write
r-x Read and Execute User can read and execute
rwx All permissions User has full access

ACL Commands 

# Set ACL for a user
setfacl -m u:username:permissions /path/to/file

# Remove ACL for a user
setfacl -x u:username /path/to/file

# Remove all ACLs
setfacl -b /path/to/file

# Copy ACL from one file to another
getfacl /file1 | setfacl --set-file=- /file2
Enter fullscreen mode Exit fullscreen mode

Alternative Approaches

Method 1: Using numeric permissions with ACLs 

chown root:root /etc/hosts
chmod 644 /etc/hosts  # rw-r--r--
setfacl -m u:john:--- /etc/hosts
setfacl -m u:eric:r-- /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Method 2: Using symbolic permissions with ACLs 

chown root:root /etc/hosts
chmod u=rw,go=r /etc/hosts  # rw-r--r--
setfacl -m u:john:--- /etc/hosts
setfacl -m u:eric:r-- /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Method 3: With default ACL (if needed for directory) 

# For directory (not applicable here but good to know)
setfacl -d -m u:eric:r-- /etc/
Enter fullscreen mode Exit fullscreen mode

Troubleshooting

  1. "setfacl: /etc/hosts: Operation not supported": 
   # Check if filesystem supports ACLs
   mount | grep " / "
   # Ensure it's mounted with acl option

   # If not, remount with acl
   mount -o remount,acl /
Enter fullscreen mode Exit fullscreen mode
  1. "User john does not exist": 
   # Create user if needed
   useradd john
   # Then set ACL
   setfacl -m u:john:--- /etc/hosts
Enter fullscreen mode Exit fullscreen mode
  1. "Invalid permission" error: 
   # Use correct permission format
   setfacl -m u:john:--- /etc/hosts
   # Or with spaces
   setfacl -m u:john:rw- /etc/hosts
Enter fullscreen mode Exit fullscreen mode
  1. View existing ACLs: 
   getfacl /etc/hosts
Enter fullscreen mode Exit fullscreen mode
  1. Remove specific ACL entry: 
   setfacl -x u:john /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Complete Solution Summary

The /etc/hosts file on App Server 3 (stapp03) has been configured with the following settings:

  • ✅ Owner: root
  • ✅ Group: root
  • ✅ Others permission: Read-only (r--)
  • ✅ User john: No permissions at all (---)
  • ✅ User eric: Read-only permission (r--)
  • ✅ Basic permissions: -rw-r--r--
  • ✅ ACLs configured and verified

The security audit findings have been addressed with proper ACL configurations on the critical /etc/hosts file.

Top comments (0)