[Linux 004] -- user and user group and Linux permission management (2), linux004

[Linux 004] -- user and user group and Linux permission management (2), linux004

To the permission. Users and user Master management in Linux are mentioned earlier. In fact, their nature (or the original intention of users and user groups) is convenient for permission management. The importance of permission management for computers is self-evident. permissions allow every user to use computers with peace of mind without worrying that other users may damage their own resources. If old Wang has a key to your house in his hand, will it hurt you a lot. As a multi-user Linux, permission management is crucial.

1. Linux File Permissions

As mentioned above, Linux requires that a file must have three permissions: The file owner permission, the file owner group permission, and other user permissions. You can run the ll command to view the permission information of a directory or a single file:

The area marked in the red box above, except for the first part, is the permission information of the file. The first parameter indicates the file type, such as Directory, common file, and link. Each of the three permissions is grouped, indicating the master permission of the file, the Group permission of the file's master, and other user permissions (I don't want to say this again ).

2. Permission Representation

Each file has three permissions: Read (r), write (w), and execute (x). If you do not have the permission, use, each user's permission to a file is an arrangement and combination of the above four identifiers:

• • ---: No permission

  • -- X: only executable

  • -W-: Write-only

  • -Wx: Only writable and executed

  • R --: Read-Only

  • R-x: Read-only and executed

  • Rw-: read/write only

  • Rwx: readable, written, and executed

If binary 1 and 0 are used to indicate that they have the corresponding permissions and do not have the corresponding permissions, the preceding permissions can be expressed:

• • 000: No Permissions

  • 001: only executable

  • 010: Only writable

  • 011: Only writable and executed

  • 100: Read-Only

  • 101: Read-only and executed

  • 110: read/write only

  • 111: readable, written, and executed

Wit, you may say: It's all a ghost. I think decimal is the standard numeric language for prostitution. Can you change it to decimal? OK:

• • 0: No Permissions

  • 1: only executable

  • 2: Only writable

  • 3: Only writable and executed

  • 4: Read-Only

  • 5: Read-only and executed

  • 6: read/write only

  • 7. read, write, and execute

This is always okay! However, you said, "There are only eight numbers in total. Why do we need to write them in decimal format? We should write them in octal! :). Fine, I will not write it here, because the above decimal to octal is the same result.

Now we know that all permissions can be 0 ~ Is it more convenient to use an octal number between 7 than r, w, x, and.

At this time, you asked another question about wit: Nima's so many numbers, each of which represents a different meaning. It's too troublesome to remember! The key is that we may still remember the mistake. You need to know that we are cool! Is there any happier way?

Let me tell you the truth: No! Now let's take a look at the Happy method of memorizing permission numbers :)

If we extract the numbers that are read-only, write-only, execute-only, and have no permissions, We can get:

• • 0: no permission
  • 1: run only
  • 2: Write only
  • 4: Read-Only

Found? Whether it is 3, 5, or 6, these permission numbers are obtained through addition operations on 0, 1, 2, and 4. The minimum value is 0, and the maximum value is 7. Therefore, 3 = 1 + 2 indicates write-only and execution-only; 5 = 4 + 1 indicates read-only and execution-only ....

Remember that you have permissions, so now let's have a pleasant chmod 777. Hmm? What is chmod? Chmod is the ultimate command for modifying permissions. before talking about this command, let's talk about the owner and group of the file !).

3. The owner of the file

Back, let's take a look at the file details in the directory listed by ll:

　　
The file owner and the owner group. To avoid this problem, we changed the owner of the file to the file owner, and asked the owner Group of the file owner about the group of the file owner. By default, the file owner is the user who creates the file, and the file owner group is the basic group of the file owner. Because no basic group is set when a charley user is created, its basic group is the default charley. If the basic group of charley is changed to Handsome, the framed content should be: charley Handsome.

In Linux, if everything can be changed, can the owner and owner Group of the file be modified? Next, we will ask you to change the air and even the root Jun of commit suiside.

4. Modify the file owner and owner group (root only)

To change the owner and owner group of a file, the root user needs two Commands: chown and chgrp.

• • Chown USERNAME file1, file2, file3. ..: Change the file owner. You can modify multiple files at a time.
  • Chown-r username dir: recursively change the owner of all files in the directory
  • Chown -- reference = PATH file1, file2. ..: Change the file owner information to be consistent with PATH.
  • Note: -- reference will modify the owner and owner group together.
  • Chown -- reference = PATH-r dir: recursive reference
  • Chown USERNAME: GROUPNAME/chown USERNAME. GROUPNAME: both the owner and owner group are changed.
  • Chown: GROUPNAME/chown. GROUPNAME: Change the owner Group

OK. The introduction is complete. What? Another chgrp didn't say it? This is actually the same as chown, but only the owner group can be modified. chown can be used to change the owner and owner group at the same time, so I use chown more.

5. chmod: Modify file permissions

The chmod Method for modifying file permissions is simple: chmod MOD file1, file2. .. the general usage is consistent with chown.

• • Chmod u = rx FILE: Modify the owner's Permissions
  • Chmod g = rwx FILE: modify the permissions of the owner Group
  • Chmod u = rx, g = x FILE: The colleague modifies the permissions of the owner and owner group.
  • Chmod o = FILE: Modify permissions of other users
  • Chmod [u | g | o] [+ |-] mod file: Adds or deletes permissions for a certain type of users.
    • Chmod u + x, g-w FILE
  • Chmod mod file: Use the octal permission value to modify the permission
    • Chmod 775 FILE
    • Chmod 000 FILE

I prefer the last method to modify permissions.

6. Create a user by modifying the configuration file

Do you still remember useradd-m username? This command is used to create a user without creating the user's home directory. If we want to manually create a user's home directory, We need to copy the files in/etc/skel to the corresponding directory, and then assign the permissions of the directory to the user. Let's take a look at the content in/etc/skel:

The framed part is the part we need to copy when manually creating the directory. Straight (shi) jue (jue) tells us that these files are related to bash. I will explain it in detail later.

In addition, we know that/etc/passwd and/etc/shadow store user-related messages, therefore, when adding users, you must manually write content to these two files (the same is true for creating a group ). The following is a brief step:

• • # Nano/etc/passwd

  • # Nano/etc/group

  • # Nano/etc/shadow

  • # Cp-r/etc/skel/home/fish

  • # Chown-R fish: fish/home/fish

  • # Chmod-R go =/home/fish

After the user is created, create the password:

• • # Passwd fish-> the password is not a hash value. We should use the encrypted password.
  • Openssl passwd and enter the password. -> The encrypted value is obtained, but no salt is added.
  • Openssl passwd-1-salt 'memeda '(1 indicates md5 encryption), and-salt indicates adding salt.
  • Paste the string generated in the upper part to/etc/shadow.

Success! Do you think the root user is very handsome.

There is another problem.

/Etc/shadow stores user password information. What are the permissions for this file? After ll, we can see: 400. Even if the root user has only the read permission, there is nothing to do with it. After all, the root user can change the space in another day. What about other users? If other users do not have the write permission, how can they modify the password? -- A common user uses passwd to start a passwd process. The owner of this process is a common user, so it cannot be modified by/etc/shadow. However, a common user can change his or her own password, which should begin with the passwd command itself.

Ll 'which passwd'. the permission of the passwd command is rwsr-xr-x. S allows common users to change their passwords. S is a special permission, so you can use passwd to change your password.

7. Check the permission again.

There is a problem that we have never considered: What is the difference between the permissions of files created by common users and those created by administrators? Let's take a look at the command line. First, common users:

Next is the root user:

It can be seen that the default permission for files created by common users is 664, while that for files created by administrators is 644. They are different.

Is there anything else that leads the default permission value for file creation?

Yes. This value is the umask mask code (reverse mask), which can be viewed in bash. For normal users, the default umask is 0002, and for root users, the default umask is 0022. The default permission for a user to create a file is the same as the maximum permission granted by the System-umask.

By default, files created in Linux do not have the execution permission. Therefore, the maximum permission is 666. Now, we know that the Administrator has created 644 file permissions and 664 file permissions for normal users.

What about directories? The maximum default permission for a directory in Linux is 777. Therefore, the default permission for directories created by common users is 775, and the default permission for directories created by administrators is 755.

8. Modify umask

Since umask has a default value, can we modify it? Yes. You only need umask NEWVAL. This method is only valid for the current logon. Check the modified result changes:

Well, we're done!

Wit, you once again stopped me and turned around: Wait, it seems like a problem. The permission is still 644. It has not been changed! The change was successful, but the system helped us change it again.

In theory, our permission should be as follows: 666-023 = 643, but why is it 644? Because Linux is a treasure, it always thinks that the newly created file cannot have the execution permission by default, so it can see that after we modify umask, the created file has the execution permission, it silently adds 1, deep merit and name.

At this point, we have finished the permission section, and we have finally lost some content.

As mentioned above, modifying umask is only valid for the current logon. If you log out and log on again, umask is reset to the default value. How can this change always be effective?

9. Linux Login Mechanism

Let's pull out the battalion commander's Italian gun and rub the last part. We can divide Shell into the following two types:

• • Logon Shell
  • Non-Logon Shell

The following is a logon Shell:

• • Ordinary users log on through a terminal
  • Administrator Logon to common users
    • Su-USERNAME
    • Su-l USERNAME

The following is a non-Logon Shell:

• • Open command window under graphic Terminal
  • Automatically executed Shell script
  • Su USERNAME (note no-or-l)

The main difference between a logon Shell and a non-Logon Shell is that the method for reading the configuration file during logon is different. There are two types of configuration files: global configuration files and personal configuration files. As the name suggests, the global configuration file takes effect for all users, and the personal configuration file takes effect only for specific users. The global configuration file is stored in/etc, and the personal configuration file is stored in ~ Of course, there is also a copy of/etc/skel. When creating a user, the configuration file will be copied from/etc/skel to its home directory by default, therefore, the default configuration files of all users are the same.

Global configuration file:

• • /Etc/profile
  • /Etc/profile. d/*. sh
  • /Etc/bashrc

Personal configuration file:

• • ~ /. Bash_profile
  • ~ /. Bashrc

The configuration file is divided into two camps: profile camp and bashrc camp. Let's take a look at their respective roles:

Profile configuration file:

• • Set Environment Variables
    • If we want to create global variables for all users, modify/etc/profile or create any file ending with. sh under/etc/profile. d/, and write the environment variables to it.
    • If you configure environment variables for a single user: Edit ~ /. Bash_profile
    • If both of them have ~ /. Bash_profile prevails
  • Run commands or scripts (for example, start or log on to the system)

Bashrc configuration file:

• • Set local variables
  • Define command alias

The login Shell reads the configuration in the following way:/etc/profile->/etc/profile. d/*. sh-> ~ /. Bash_profile-> ~ /. Bashrc->/erc/bashrc

Non-login Shell read configuration method :~ /. Bashrc->/etc/profile, d/*. sh

Visible: Non-login Shell does not read/etc/profile and ~ /. Bash_profile. Therefore, the configurations read by the su and su-users are inconsistent. Su is also called semi-switching, and su-(su-l) is called full switching.

Now we know that if we want to define the command alias and local variables to be valid, We need to write the definition into the configuration file (Global or personal ), if you want to distinguish between a logon Shell and a non-Logon Shell, you need to write the configuration to/etc/profile or ~ /. Bash_profile.

10. Summary

This article mainly introduces Linux permission management, including Linux permission expression, permission modification, file owner and owner group modification, and umask mask code. Finally, we will introduce the Linux configuration files, including global configuration and personal configuration, as well as the differences between a logon Shell and a non-Logon Shell.

Thank you for watching.

 

 

Author: fried meatballs reproduced please indicate the source: http://www.cnblogs.com/charleylla/p/5980300.html