DEV Community

Janak Shrestha
Janak Shrestha

Posted on

Mastering Linux ACLs: Setting Fine-Grained Permissions on Critical System Files

#linux

The Nautilus security team performed an audit on all servers present in Stratos DC. During the audit some critical data/files were identified which were having the wrong permissions as per security standards. Once the report was shared with the production support team, they started fixing the issues one by one. It has been identified that one of the files named /etc/hostname on Nautilus App 2 server has wrong permissions, so that needs to be fixed and the correct ACLs needs to be applied.

a. User virat must not have any permission on this file.

b. User vivek should have read only permission on this file. Further, sysadmin group should have read/write permissions on this file.

Solution

Step 1: Connect to App Server 2 (stapp02) 

ssh steve@stapp02
# Password: Am3ric@
Enter fullscreen mode Exit fullscreen mode

Step 2: Switch to root 

sudo su -
# Password: Am3ric@
Enter fullscreen mode Exit fullscreen mode

Step 3: Check current permissions 

ls -la /etc/hostname
getfacl /etc/hostname
Enter fullscreen mode Exit fullscreen mode

Step 4: Set basic permissions 

# Set owner and group to root
chown root:root /etc/hostname

# Set permissions (644 = rw-r--r--)
chmod 644 /etc/hostname
Enter fullscreen mode Exit fullscreen mode

Step 5: Configure ACLs 

# Remove any existing ACLs for these users/groups
setfacl -x u:virat /etc/hostname 2>/dev/null
setfacl -x u:vivek /etc/hostname 2>/dev/null
setfacl -x g:sysadmin /etc/hostname 2>/dev/null

# a. virat - no permissions
setfacl -m u:virat:--- /etc/hostname

# b. vivek - read only
setfacl -m u:vivek:r-- /etc/hostname

# c. sysadmin group - read/write
setfacl -m g:sysadmin:rw- /etc/hostname
Enter fullscreen mode Exit fullscreen mode

Step 6: Verify configuration 

ls -la /etc/hostname
getfacl /etc/hostname
Enter fullscreen mode Exit fullscreen mode

One-Line Command 

echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'chown root:root /etc/hostname && chmod 644 /etc/hostname && setfacl -x u:virat /etc/hostname 2>/dev/null && setfacl -x u:vivek /etc/hostname 2>/dev/null && setfacl -x g:sysadmin /etc/hostname 2>/dev/null && setfacl -m u:virat:--- /etc/hostname && setfacl -m u:vivek:r-- /etc/hostname && setfacl -m g:sysadmin:rw- /etc/hostname && getfacl /etc/hostname'"
Enter fullscreen mode Exit fullscreen mode

Expected Output 

[root@stapp02 ~]# chown root:root /etc/hostname
[root@stapp02 ~]# chmod 644 /etc/hostname

[root@stapp02 ~]# setfacl -m u:virat:--- /etc/hostname
[root@stapp02 ~]# setfacl -m u:vivek:r-- /etc/hostname
[root@stapp02 ~]# setfacl -m g:sysadmin:rw- /etc/hostname

[root@stapp02 ~]# getfacl /etc/hostname
getfacl: Removing leading '/' from absolute path names
# file: etc/hostname
# owner: root
# group: root
user::rw-
user:virat:---
user:vivek:r--
group::r--
group:sysadmin:rw-
mask::rw-
other::r--
Enter fullscreen mode Exit fullscreen mode

Verification Commands 

# Check basic permissions
ls -la /etc/hostname

# Check ACLs
getfacl /etc/hostname

# Verify specific entries
getfacl /etc/hostname | grep -E "virat|vivek|sysadmin"

# Test virat (should fail)
sudo -u virat cat /etc/hostname 2>&1 | head -1

# Test vivek (should succeed)
sudo -u vivek cat /etc/hostname 2>&1 | head -1
Enter fullscreen mode Exit fullscreen mode

Summary

  • ✅ Owner: root, Group: root
  • ✅ Permissions: rw-r--r-- (644)
  • ✅ virat: No permissions (---)
  • ✅ vivek: Read only (r--)
  • ✅ sysadmin group: Read/Write (rw-)

ACLs configured successfully on /etc/hostname.

Top comments (0)